|
|
TCP |
3000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3000 · (reconnaissance) · → /config.toml
|
Élevée
|
Moyen · 47
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /config.toml UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/config.toml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/config.toml
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Moyen
· 47
Confiance : Confiance 52 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /config.toml HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /config.toml HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537
Requête brute (extrait)
GET /config.toml HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "toml",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "9143df5dbda21bd8fe091512028bb95a28535a1e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 209,
"payload_entropy": 5.294485933592096,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 60,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 47,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "23a9ef5c72f78da81056c29dd5967bab89d31d6d",
"event_fingerprint": "f02d26a517bfdd0c1a1daab956323c5981e99250",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "061f6d78649b887ef97f9cc8f3527786",
"path_pattern_hash": "5932557804ccd992bd00d388ff9976b6"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/config.toml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"method": "GET",
"path": "\/config.toml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config.toml HTTP\/1.1",
"request_sample": "GET \/config.toml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/config.toml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"evidence": {
"method": "GET",
"path": "\/config.toml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config.toml HTTP\/1.1",
"request_sample": "GET \/config.toml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/config.toml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fe86d8fd547cb4861474c3c82a422b0809844d5d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config.toml",
"request_line": "GET \/config.toml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config.toml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/config.toml",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config.toml",
"request_line": "GET \/config.toml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/config.toml",
"evidence_snippet": "GET \/config.toml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3000 · (reconnaissance) · → /serverless.yaml
|
Élevée
|
Moyen · 47
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /serverless.yaml UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/serverless.yaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/serverless.yaml
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Moyen
· 47
Confiance : Confiance 52 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /serverless.yaml HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /serverless.yaml HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
Requête brute (extrait)
GET /serverless.yaml HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yaml",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "20fa0af813635ad0a35851be2ee30a3c843c4ea6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 213,
"payload_entropy": 5.312298045797454,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 60,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 47,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "23a9ef5c72f78da81056c29dd5967bab89d31d6d",
"event_fingerprint": "daaa121ba1de8009f3d87c7fa83ef061293f95b9",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "4b188f28aa089449c89b647e62b3aa6f",
"path_pattern_hash": "ee0bed76f96369bfa82cc3ee3c740180"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/serverless.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"method": "GET",
"path": "\/serverless.yaml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/serverless.yaml HTTP\/1.1",
"request_sample": "GET \/serverless.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/serverless.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"evidence": {
"method": "GET",
"path": "\/serverless.yaml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/serverless.yaml HTTP\/1.1",
"request_sample": "GET \/serverless.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/serverless.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "aefaf76c28e711e51ac62fe69b51ab7f8ae26aa6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/serverless.yaml",
"request_line": "GET \/serverless.yaml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/serverless.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/serverless.yaml",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/serverless.yaml",
"request_line": "GET \/serverless.yaml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/serverless.yaml",
"evidence_snippet": "GET \/serverless.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3000 · (reconnaissance) · → /config/development.json
|
Élevée
|
Moyen · 56
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /config/development.json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_probe_config
Cible HTTP
GET
/config/development.json
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/config/development.json
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Moyen
· 56
Confiance : Confiance 52 % — 3 tag(s) WAF
Protocole émulé
1
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /config/development.json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /config/development.json HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) App
Requête brute (extrait)
GET /config/development.json HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "83fdc78a74d9ababefd2eba12b4abcf9700bdc67",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 221,
"payload_entropy": 5.316895727700472,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 84,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 56,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "abec87d76f79a4193f0d7d153ddbde6e82ac0ec1",
"event_fingerprint": "d968b7f93ef4dea3edc55bf043b4287f8c543d7d",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 56
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "ce0bc1e6b09c74234c074f1af3228862",
"path_pattern_hash": "0e32f732e96f4197aa471e2ce98e2fff"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/config\/development.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App",
"method": "GET",
"path": "\/config\/development.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/development.json HTTP\/1.1",
"request_sample": "GET \/config\/development.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/config\/development.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App",
"evidence": {
"method": "GET",
"path": "\/config\/development.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/development.json HTTP\/1.1",
"request_sample": "GET \/config\/development.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/config\/development.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b43c599b536cd07d25061e94cc8160932609ffd4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/development.json",
"request_line": "GET \/config\/development.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/development.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App",
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/config\/development.json",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 56
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/development.json",
"request_line": "GET \/config\/development.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/config\/development.json",
"evidence_snippet": "GET \/config\/development.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_config",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3000 · (reconnaissance) · → /config/default.json
|
Élevée
|
Moyen · 56
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /config/default.json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_probe_config
Cible HTTP
GET
/config/default.json
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/config/default.json
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Moyen
· 56
Confiance : Confiance 52 % — 3 tag(s) WAF
Protocole émulé
1
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /config/default.json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /config/default.json HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET /config/default.json HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "0bb996ed943aeae59cfe84e3ce56accbdf9fb0d7",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 217,
"payload_entropy": 5.318755569135829,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 84,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 56,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "abec87d76f79a4193f0d7d153ddbde6e82ac0ec1",
"event_fingerprint": "94bf832d1b0cc5bb393bb55cabab0a083a0be103",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 56
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "06b6759884dcbec6ffb1c925447393fc",
"path_pattern_hash": "12fc2bfc98c2463f1958377de187dd00"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/config\/default.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/config\/default.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/default.json HTTP\/1.1",
"request_sample": "GET \/config\/default.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/config\/default.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/config\/default.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/default.json HTTP\/1.1",
"request_sample": "GET \/config\/default.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/config\/default.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f2658842ff16d4b36fc9dd1b0bc415b38315b7f4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/default.json",
"request_line": "GET \/config\/default.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/default.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/config\/default.json",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 56
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/default.json",
"request_line": "GET \/config\/default.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/config\/default.json",
"evidence_snippet": "GET \/config\/default.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_config",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3000 · (reconnaissance) · → /conf/settings.json
|
Élevée
|
Moyen · 55
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /conf/settings.json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/conf/settings.json
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/conf/settings.json
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Moyen
· 55
Confiance : Confiance 52 % — 3 tag(s) WAF
Protocole émulé
1
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /conf/settings.json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /conf/settings.json HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb
Requête brute (extrait)
GET /conf/settings.json HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "4ce782018e9558e60e3b6794f4e4ba2fd99c3b58",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 216,
"payload_entropy": 5.290793146519683,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 84,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 55,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9c903ab5520136a90667f58ed289b667d4f29a84",
"event_fingerprint": "e7782f0ca4a1af411f3a1e87f8b8d831fee88557",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 55
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "8e9fab6006aa95a00424002ae2c98374",
"path_pattern_hash": "53a71844e15d327eefa2ad7c6acfcf79"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET \/conf\/settings.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWeb",
"method": "GET",
"path": "\/conf\/settings.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/conf\/settings.json HTTP\/1.1",
"request_sample": "GET \/conf\/settings.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/conf\/settings.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWeb",
"evidence": {
"method": "GET",
"path": "\/conf\/settings.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/conf\/settings.json HTTP\/1.1",
"request_sample": "GET \/conf\/settings.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/conf\/settings.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWeb",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "96da3552fe4057e5b78b7740b47cf09f432af6db",
"protocol_details": {
"http_method": "GET",
"http_path": "\/conf\/settings.json",
"request_line": "GET \/conf\/settings.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/conf\/settings.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWeb",
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/conf\/settings.json",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 55
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/conf\/settings.json",
"request_line": "GET \/conf\/settings.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/conf\/settings.json",
"evidence_snippet": "GET \/conf\/settings.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWeb",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3000 · (reconnaissance) · → /appsettings.Development.json
|
Élevée
|
Moyen · 47
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /appsettings.Development.json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/appsettings.Development.json
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/appsettings.Development.json
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Moyen
· 47
Confiance : Confiance 52 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /appsettings.Development.json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /appsettings.Development.json HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64
Requête brute (extrait)
GET /appsettings.Development.json HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "json",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "b16cc04f90b07f94f00559b7a5b80f472688ce81",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 226,
"payload_entropy": 5.311359425415632,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 60,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 47,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "23a9ef5c72f78da81056c29dd5967bab89d31d6d",
"event_fingerprint": "111416b9000e544888e892b7e50830f81f59d518",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "0ad30617061e2fd109b2f5e246953546",
"path_pattern_hash": "42f6207a734c8447ca0a471ac752ed62"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/appsettings.Development.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64",
"method": "GET",
"path": "\/appsettings.Development.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/appsettings.Development.json HTTP\/1.1",
"request_sample": "GET \/appsettings.Development.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/appsettings.Development.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64",
"evidence": {
"method": "GET",
"path": "\/appsettings.Development.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/appsettings.Development.json HTTP\/1.1",
"request_sample": "GET \/appsettings.Development.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/appsettings.Development.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "60a799d562ac49b1e438fb1458c9476527ada7fd",
"protocol_details": {
"http_method": "GET",
"http_path": "\/appsettings.Development.json",
"request_line": "GET \/appsettings.Development.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/appsettings.Development.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64",
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/appsettings.Development.json",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/appsettings.Development.json",
"request_line": "GET \/appsettings.Development.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/appsettings.Development.json",
"evidence_snippet": "GET \/appsettings.Development.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3000 · (reconnaissance) · → /appsettings.Production.json
|
Élevée
|
Moyen · 47
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /appsettings.Production.json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/appsettings.Production.json
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/appsettings.Production.json
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Moyen
· 47
Confiance : Confiance 52 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /appsettings.Production.json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /appsettings.Production.json HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Requête brute (extrait)
GET /appsettings.Production.json HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "json",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "3ae157cd8c43defb5d30e0d7c5c707aa388091b2",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 225,
"payload_entropy": 5.304028573371013,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 60,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 47,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "23a9ef5c72f78da81056c29dd5967bab89d31d6d",
"event_fingerprint": "de659fc03ed2679a9cc098cbb25387bc44b1962f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "3a32c06cfe6480252f6335df190bc34f",
"path_pattern_hash": "650438fe08df7df13d88963bd8b41670"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/appsettings.Production.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)",
"method": "GET",
"path": "\/appsettings.Production.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/appsettings.Production.json HTTP\/1.1",
"request_sample": "GET \/appsettings.Production.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/appsettings.Production.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)",
"evidence": {
"method": "GET",
"path": "\/appsettings.Production.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/appsettings.Production.json HTTP\/1.1",
"request_sample": "GET \/appsettings.Production.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/appsettings.Production.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d6a3874620c003c9ad379562f975c322b517e38a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/appsettings.Production.json",
"request_line": "GET \/appsettings.Production.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/appsettings.Production.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)",
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/appsettings.Production.json",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/appsettings.Production.json",
"request_line": "GET \/appsettings.Production.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/appsettings.Production.json",
"evidence_snippet": "GET \/appsettings.Production.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3000 · (reconnaissance) · → /config.yaml
|
Élevée
|
Moyen · 47
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /config.yaml UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/config.yaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/config.yaml
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Moyen
· 47
Confiance : Confiance 52 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /config.yaml HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /config.yaml HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537
Requête brute (extrait)
GET /config.yaml HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yaml",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "ffa41e7ee4cc6f247a90f813aaf1a8798f7d8d0e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 209,
"payload_entropy": 5.316925914146607,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 60,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 47,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b6eec39e24df18329c920374a0bd44f90e085b9a",
"event_fingerprint": "eb901dd3619645778c6e4df5b8344c23da18c8b6",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "1ca4f0ac6d1aacc2dfd44c484191aafe",
"path_pattern_hash": "01019d2319e003d8a4b16afde95af798"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/config.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"method": "GET",
"path": "\/config.yaml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config.yaml HTTP\/1.1",
"request_sample": "GET \/config.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/config.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"evidence": {
"method": "GET",
"path": "\/config.yaml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config.yaml HTTP\/1.1",
"request_sample": "GET \/config.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/config.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "305d5e8ae5f50643e37a1e1404aa9d584448d3ca",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config.yaml",
"request_line": "GET \/config.yaml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/config.yaml",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config.yaml",
"request_line": "GET \/config.yaml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/config.yaml",
"evidence_snippet": "GET \/config.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3000 · (reconnaissance) · → /config.yml
|
Élevée
|
Moyen · 47
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /config.yml UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/config.yml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/config.yml
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Moyen
· 47
Confiance : Confiance 52 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /config.yml HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /config.yml HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.
Requête brute (extrait)
GET /config.yml HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yml",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "9c71a471d1741f25c6a0cf33633b97ca741711ba",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 208,
"payload_entropy": 5.317264679591217,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 60,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 47,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b6eec39e24df18329c920374a0bd44f90e085b9a",
"event_fingerprint": "42a9b072e185955053257a5b1f0dfdd4dc714c21",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "797285fab9eecbb5b0d9cd24a5ff38df",
"path_pattern_hash": "0a2918ddc0ec44a5e60099bb735403f8"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/config.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"method": "GET",
"path": "\/config.yml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config.yml HTTP\/1.1",
"request_sample": "GET \/config.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/config.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/config.yml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config.yml HTTP\/1.1",
"request_sample": "GET \/config.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/config.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3921d3897f4bf33990f1cf1714c608e6051c83f4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config.yml",
"request_line": "GET \/config.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/config.yml",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config.yml",
"request_line": "GET \/config.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/config.yml",
"evidence_snippet": "GET \/config.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3000 · (reconnaissance) · → /application.yml
|
Élevée
|
Moyen · 47
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /application.yml UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/application.yml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/application.yml
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Moyen
· 47
Confiance : Confiance 52 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /application.yml HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /application.yml HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
Requête brute (extrait)
GET /application.yml HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yml",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "b5819b2c14e2e66f80448b9cafafa1033e7b1cec",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 213,
"payload_entropy": 5.297300352791286,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 60,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 47,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b6eec39e24df18329c920374a0bd44f90e085b9a",
"event_fingerprint": "dd27a1fb7c13c3d30f3d39d1c65deeb86378a59e",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "0440b9f873e0607f8582595c7b4ec3e6",
"path_pattern_hash": "18101755b44cc6d8b270134bcce32edf"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/application.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"method": "GET",
"path": "\/application.yml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/application.yml HTTP\/1.1",
"request_sample": "GET \/application.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/application.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"evidence": {
"method": "GET",
"path": "\/application.yml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/application.yml HTTP\/1.1",
"request_sample": "GET \/application.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/application.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "537d8c87efc16042e8752083a66c98fde3adcbe4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/application.yml",
"request_line": "GET \/application.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/application.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/application.yml",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/application.yml",
"request_line": "GET \/application.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/application.yml",
"evidence_snippet": "GET \/application.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3000 · (reconnaissance) · → /application.yaml
|
Élevée
|
Moyen · 47
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /application.yaml UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/application.yaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/application.yaml
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Moyen
· 47
Confiance : Confiance 52 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /application.yaml HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /application.yaml HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi
Requête brute (extrait)
GET /application.yaml HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yaml",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "1191e273c1826d3cef67d2c70d425072ebc43c59",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 214,
"payload_entropy": 5.295127315797602,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 60,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 47,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b6eec39e24df18329c920374a0bd44f90e085b9a",
"event_fingerprint": "cb00d84ff61f4e19732173cc89fb1cdc90200e13",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "123b0bcd779c7f20890b9d261d917879",
"path_pattern_hash": "cef87ee8c99d38579e29ea993d58f554"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/application.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
"method": "GET",
"path": "\/application.yaml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/application.yaml HTTP\/1.1",
"request_sample": "GET \/application.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/application.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
"evidence": {
"method": "GET",
"path": "\/application.yaml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/application.yaml HTTP\/1.1",
"request_sample": "GET \/application.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/application.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ec930251e5549046e1f46bf6d862d41b39c6bfd6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/application.yaml",
"request_line": "GET \/application.yaml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/application.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/application.yaml",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/application.yaml",
"request_line": "GET \/application.yaml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/application.yaml",
"evidence_snippet": "GET \/application.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3000 · (reconnaissance) · → /application-dev.properties
|
Élevée
|
Moyen · 47
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /application-dev.properties UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/application-dev.properties
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/application-dev.properties
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Moyen
· 47
Confiance : Confiance 52 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /application-dev.properties HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /application-dev.properties HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Requête brute (extrait)
GET /application-dev.properties HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "properties",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "1c00232df0f9171cd1c8c41a2ab578caf973d6db",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 224,
"payload_entropy": 5.289762249517494,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 60,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 47,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "23a9ef5c72f78da81056c29dd5967bab89d31d6d",
"event_fingerprint": "97f1a7f11e2157d7c9c282ffcba5eeed3d7fd6f7",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "e16649e252525052e730a6d18a3f187a",
"path_pattern_hash": "dc582c7aa48543d5aa6765449e8f0b6a"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/application-dev.properties HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) ",
"method": "GET",
"path": "\/application-dev.properties",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/application-dev.properties HTTP\/1.1",
"request_sample": "GET \/application-dev.properties HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/application-dev.properties HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)",
"evidence": {
"method": "GET",
"path": "\/application-dev.properties",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/application-dev.properties HTTP\/1.1",
"request_sample": "GET \/application-dev.properties HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/application-dev.properties HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4c30a44c9857b0bb5616e374474736ea4260d294",
"protocol_details": {
"http_method": "GET",
"http_path": "\/application-dev.properties",
"request_line": "GET \/application-dev.properties HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/application-dev.properties HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)",
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/application-dev.properties",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/application-dev.properties",
"request_line": "GET \/application-dev.properties HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/application-dev.properties",
"evidence_snippet": "GET \/application-dev.properties HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3000 · (reconnaissance) · → /appsettings.json
|
Élevée
|
Moyen · 47
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /appsettings.json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/appsettings.json
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/appsettings.json
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Moyen
· 47
Confiance : Confiance 52 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Motifs de détection (base)
Cred ASP.NET settings
Ligne de requête
GET /appsettings.json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /appsettings.json HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi
Requête brute (extrait)
GET /appsettings.json HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "json",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "1bb70c4d477e16ecbd1bc700e3f66fae61eb4898",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 214,
"payload_entropy": 5.2961877229587415,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 60,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 47,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b6eec39e24df18329c920374a0bd44f90e085b9a",
"event_fingerprint": "5791f0a012f6bda59965b0a1f9a438160e9d0772",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"matched_patterns": [
"pat-0466"
],
"matched_pattern_names": [
"Cred ASP.NET settings"
],
"pattern_ids": [
"pat-0466"
],
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "e46a471f3796679aa66086e03c7688e2",
"path_pattern_hash": "8a0b1852fc2be645a82e96b3e5fdd755"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/appsettings.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
"method": "GET",
"path": "\/appsettings.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/appsettings.json HTTP\/1.1",
"request_sample": "GET \/appsettings.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/appsettings.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
"evidence": {
"method": "GET",
"path": "\/appsettings.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/appsettings.json HTTP\/1.1",
"request_sample": "GET \/appsettings.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/appsettings.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ddabca080c2c113b53b84786e1ec8ca3c32c075d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/appsettings.json",
"request_line": "GET \/appsettings.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/appsettings.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/appsettings.json",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/appsettings.json",
"request_line": "GET \/appsettings.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/appsettings.json",
"evidence_snippet": "GET \/appsettings.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3000 · (reconnaissance) · → /config/master.key
|
Élevée
|
Moyen · 56
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /config/master.key UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_probe_config
Cible HTTP
GET
/config/master.key
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/config/master.key
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Moyen
· 56
Confiance : Confiance 52 % — 3 tag(s) WAF
Protocole émulé
1
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /config/master.key HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /config/master.key HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK
Requête brute (extrait)
GET /config/master.key HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "key",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "278ef868771413556c8713a5e16fcf7c97a9fbd2",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 215,
"payload_entropy": 5.313965093179797,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 84,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 56,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "abec87d76f79a4193f0d7d153ddbde6e82ac0ec1",
"event_fingerprint": "4a7d1a2e1c633bf8113e6c74dda5a9bf2902bde2",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 56
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "66d8f532d4bc52233eb0e3a0f8ebc013",
"path_pattern_hash": "b99ec2315f369daaa07f08c32272fcc3"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/config\/master.key HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebK",
"method": "GET",
"path": "\/config\/master.key",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/master.key HTTP\/1.1",
"request_sample": "GET \/config\/master.key HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/config\/master.key HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebK",
"evidence": {
"method": "GET",
"path": "\/config\/master.key",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/master.key HTTP\/1.1",
"request_sample": "GET \/config\/master.key HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/config\/master.key HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebK",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b7b3ce7491ac7ea3058038fbe8e34701acf01187",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/master.key",
"request_line": "GET \/config\/master.key HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/master.key HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebK",
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/config\/master.key",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 56
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/master.key",
"request_line": "GET \/config\/master.key HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/config\/master.key",
"evidence_snippet": "GET \/config\/master.key HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebK",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_config",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3000 · (tentative d'exploit) · → /wp-config.php.old
|
Élevée
|
Élevé · 70
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /wp-config.php.old UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950518:leak-5
950521:leak-8
Cible HTTP
GET
/wp-config.php.old
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/wp-config.php.old
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0195
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 933111
Probe /wp-config.php
Ligne de requête
GET /wp-config.php.old HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-5
leak-8
Payload (extrait)
GET /wp-config.php.old HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK
Requête brute (extrait)
GET /wp-config.php.old HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "old",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "24c516a67db44cfad409a699aaddb7e13edd5983",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 215,
"payload_entropy": 5.315698406399814,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.6,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "33330b5691c4d3ef0ff1c59f8737c66cd6409cd2",
"event_fingerprint": "510b1722a8a231c3b61c3c04ab0dea86533cec38",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0195",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0195",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0160",
"pat-0195"
],
"matched_pattern_names": [
"CRS 933111",
"Probe \/wp-config.php"
],
"pattern_ids": [
"pat-0160",
"pat-0195"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "e33f84fb5514875f8793950a15849027",
"path_pattern_hash": "5fcd528564d98f34a98115294a2df668"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/wp-config.php.old HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebK",
"method": "GET",
"path": "\/wp-config.php.old",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950518:leak-5",
"950521:leak-8"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-5",
"leak-8"
],
"request_line": "GET \/wp-config.php.old HTTP\/1.1",
"request_sample": "GET \/wp-config.php.old HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/wp-config.php.old HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebK",
"evidence": {
"method": "GET",
"path": "\/wp-config.php.old",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950518:leak-5",
"950521:leak-8"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-5",
"leak-8"
],
"request_line": "GET \/wp-config.php.old HTTP\/1.1",
"request_sample": "GET \/wp-config.php.old HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/wp-config.php.old HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebK",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6ddc1fa44cbbbed6157878fca138412fbda224b5",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-config.php.old",
"request_line": "GET \/wp-config.php.old HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/wp-config.php.old HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebK",
"attack_vector": "config file probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-config.php.old",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0195",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0195",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-config.php.old",
"request_line": "GET \/wp-config.php.old HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-config.php.old",
"evidence_snippet": "GET \/wp-config.php.old HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebK",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950518:leak-5",
"950521:leak-8",
"http_backup_file_scan",
"http_backup_path",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3000 · (tentative d'exploit) · → /wp-config.php.save
|
Élevée
|
Élevé · 67
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /wp-config.php.save UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950518:leak-5
http_backup_file_scan
Cible HTTP
GET
/wp-config.php.save
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/wp-config.php.save
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0195
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 933111
Probe /wp-config.php
Ligne de requête
GET /wp-config.php.save HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-5
Payload (extrait)
GET /wp-config.php.save HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb
Requête brute (extrait)
GET /wp-config.php.save HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "save",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "440cbf7653353c59cd0ec5c251a941c94aae51e3",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 216,
"payload_entropy": 5.3255335360502505,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 67,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "23dfc3ce1bf8084f8f3416a6f5119d2e58504f3a",
"event_fingerprint": "a6d8087bcba9c1ab01c22694617ae1588d2fe719",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0195",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0195",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0160",
"pat-0195"
],
"matched_pattern_names": [
"CRS 933111",
"Probe \/wp-config.php"
],
"pattern_ids": [
"pat-0160",
"pat-0195"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 67
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "23581681393ad283c0a251a903551fac",
"path_pattern_hash": "95b05a03890a8b1f9bd7471b8fc2d6d2"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"payload_preview": "GET \/wp-config.php.save HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWeb",
"method": "GET",
"path": "\/wp-config.php.save",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950518:leak-5"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-5"
],
"request_line": "GET \/wp-config.php.save HTTP\/1.1",
"request_sample": "GET \/wp-config.php.save HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/wp-config.php.save HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWeb",
"evidence": {
"method": "GET",
"path": "\/wp-config.php.save",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950518:leak-5"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-5"
],
"request_line": "GET \/wp-config.php.save HTTP\/1.1",
"request_sample": "GET \/wp-config.php.save HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/wp-config.php.save HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWeb",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "56574a2b4740b8ce56e07757b1383ea50b313a7a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-config.php.save",
"request_line": "GET \/wp-config.php.save HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/wp-config.php.save HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWeb",
"attack_vector": "config file probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-config.php.save",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 67
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0195",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0195",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-config.php.save",
"request_line": "GET \/wp-config.php.save HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-config.php.save",
"evidence_snippet": "GET \/wp-config.php.save HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWeb",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950518:leak-5",
"http_backup_file_scan",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3000 · (tentative d'exploit) · → /wp-config.php.txt
|
Élevée
|
Élevé · 67
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /wp-config.php.txt UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950518:leak-5
http_backup_file_scan
Cible HTTP
GET
/wp-config.php.txt
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/wp-config.php.txt
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0195
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 933111
Probe /wp-config.php
Ligne de requête
GET /wp-config.php.txt HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-5
Payload (extrait)
GET /wp-config.php.txt HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK
Requête brute (extrait)
GET /wp-config.php.txt HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "6a0f57eb7bae6019bcd12e05a2a5a99ca0f24d82",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 215,
"payload_entropy": 5.318248390054774,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 67,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "23dfc3ce1bf8084f8f3416a6f5119d2e58504f3a",
"event_fingerprint": "7180cfbd18535774b1a42ee24bddedc29a903435",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0195",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0195",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0160",
"pat-0195"
],
"matched_pattern_names": [
"CRS 933111",
"Probe \/wp-config.php"
],
"pattern_ids": [
"pat-0160",
"pat-0195"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 67
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "a70572b726dea51608dedbba47d4ebe2",
"path_pattern_hash": "d2b16bf79ee85d394a5f000d8ef2ea4b"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"payload_preview": "GET \/wp-config.php.txt HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebK",
"method": "GET",
"path": "\/wp-config.php.txt",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950518:leak-5"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-5"
],
"request_line": "GET \/wp-config.php.txt HTTP\/1.1",
"request_sample": "GET \/wp-config.php.txt HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/wp-config.php.txt HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebK",
"evidence": {
"method": "GET",
"path": "\/wp-config.php.txt",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950518:leak-5"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-5"
],
"request_line": "GET \/wp-config.php.txt HTTP\/1.1",
"request_sample": "GET \/wp-config.php.txt HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/wp-config.php.txt HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebK",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fa3b723226e19cd182c484d8ca5ba0270709abf7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-config.php.txt",
"request_line": "GET \/wp-config.php.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/wp-config.php.txt HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebK",
"attack_vector": "config file probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-config.php.txt",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 67
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0195",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0195",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-config.php.txt",
"request_line": "GET \/wp-config.php.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-config.php.txt",
"evidence_snippet": "GET \/wp-config.php.txt HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebK",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950518:leak-5",
"http_backup_file_scan",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3000 · (reconnaissance) · → /config/app.php
|
Élevée
|
Moyen · 56
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /config/app.php UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_probe_config
Cible HTTP
GET
/config/app.php
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/config/app.php
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Moyen
· 56
Confiance : Confiance 52 % — 3 tag(s) WAF
Protocole émulé
1
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /config/app.php HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /config/app.php HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/
Requête brute (extrait)
GET /config/app.php HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "php",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "4d388b5973ca832ef2abea7dc7b3d1d0491429b6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 212,
"payload_entropy": 5.295371360136907,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 84,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 56,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "abec87d76f79a4193f0d7d153ddbde6e82ac0ec1",
"event_fingerprint": "7da50480f7a6ff126cbee7ed318bb260b1eb0b81",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 56
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "a50ac11952b72463c7ce4c74f0731a53",
"path_pattern_hash": "1bde6fec443f458560d30e82dbf9f869"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/config\/app.php HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/",
"method": "GET",
"path": "\/config\/app.php",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/app.php HTTP\/1.1",
"request_sample": "GET \/config\/app.php HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/config\/app.php HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/",
"evidence": {
"method": "GET",
"path": "\/config\/app.php",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/app.php HTTP\/1.1",
"request_sample": "GET \/config\/app.php HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/config\/app.php HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7fb739e381e9c97ea991a9369b7451558fb8bdd7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/app.php",
"request_line": "GET \/config\/app.php HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/app.php HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/",
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/config\/app.php",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 56
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/app.php",
"request_line": "GET \/config\/app.php HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/config\/app.php",
"evidence_snippet": "GET \/config\/app.php HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_config",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Traversal LFI
lfi path traversal · via HTTP:3000 · (tentative d'exploit) · → /js/app.js
|
Élevée
|
Moyen · 64
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /js/app.js UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/js/app.js
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/js/app.js
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 64
Confiance : Confiance 59 % — 4 tag(s) WAF
Protocole émulé
1
Signaux
CRS-930100-sub
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /js/app.js HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-14
rce-0
nosqli-3
Payload (extrait)
GET /js/app.js HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3
Requête brute (extrait)
GET /js/app.js HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "js",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "a22d1d868692973288e25c89f766247feac6353d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 207,
"payload_entropy": 5.310626126186084,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f02e8800c6e00a1ad068d34d4b81544ce061b851",
"event_fingerprint": "89e56c3667d5b4fb0f40f3f534350495348e45e4",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100-sub"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "ad498b022edf3a683b0b7bb9d5c7798c",
"path_pattern_hash": "de7fe7d5b9603182c141cba6f00e2511"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/js\/app.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"method": "GET",
"path": "\/js\/app.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/js\/app.js HTTP\/1.1",
"request_sample": "GET \/js\/app.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/js\/app.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"evidence": {
"method": "GET",
"path": "\/js\/app.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/js\/app.js HTTP\/1.1",
"request_sample": "GET \/js\/app.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/js\/app.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "539509ffaee53af89145f87b092e692a6587676c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/js\/app.js",
"request_line": "GET \/js\/app.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/js\/app.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"attack_vector": "lfi path traversal \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/js\/app.js",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/js\/app.js",
"request_line": "GET \/js\/app.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/js\/app.js",
"evidence_snippet": "GET \/js\/app.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Traversal LFI
lfi path traversal · via HTTP:3000 · (tentative d'exploit) · → /js/main.js
|
Élevée
|
Moyen · 64
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /js/main.js UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/js/main.js
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/js/main.js
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 64
Confiance : Confiance 59 % — 4 tag(s) WAF
Protocole émulé
1
Signaux
CRS-930100-sub
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /js/main.js HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-14
rce-0
nosqli-3
Payload (extrait)
GET /js/main.js HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.
Requête brute (extrait)
GET /js/main.js HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "js",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "552514a6107abe9547d76917c28e0d1a27e18542",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 208,
"payload_entropy": 5.311556717635127,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f02e8800c6e00a1ad068d34d4b81544ce061b851",
"event_fingerprint": "9f8bced821c638ad1ceb1e58727f9d6cc5fdfe3a",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100-sub"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "99e743a9c5522195fd838d4b11a3917e",
"path_pattern_hash": "f10d571ea51fd1a0b4c78eea472da68f"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/js\/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"method": "GET",
"path": "\/js\/main.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/js\/main.js HTTP\/1.1",
"request_sample": "GET \/js\/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/js\/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/js\/main.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/js\/main.js HTTP\/1.1",
"request_sample": "GET \/js\/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/js\/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cecb0cb161f29306fff97282f8b2f4f52f04b75a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/js\/main.js",
"request_line": "GET \/js\/main.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/js\/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"attack_vector": "lfi path traversal \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/js\/main.js",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/js\/main.js",
"request_line": "GET \/js\/main.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/js\/main.js",
"evidence_snippet": "GET \/js\/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3000 · (reconnaissance) · → /config.py
|
Élevée
|
Moyen · 47
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /config.py UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/config.py
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/config.py
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Moyen
· 47
Confiance : Confiance 52 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /config.py HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /config.py HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3
Requête brute (extrait)
GET /config.py HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "py",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "37d31b2983288f908ec26b6131cac26b5c1bacbc",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 207,
"payload_entropy": 5.311625189449468,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 60,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 47,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "23a9ef5c72f78da81056c29dd5967bab89d31d6d",
"event_fingerprint": "26dcff63270553609366fb0f9d054918757aa36c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "a4e4d15b18fcaac273641572fcbb2d49",
"path_pattern_hash": "96ad2fe85e6dcc0e779ed46379d98575"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/config.py HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"method": "GET",
"path": "\/config.py",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config.py HTTP\/1.1",
"request_sample": "GET \/config.py HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/config.py HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"evidence": {
"method": "GET",
"path": "\/config.py",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config.py HTTP\/1.1",
"request_sample": "GET \/config.py HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/config.py HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4740b2e8e5fef62ccfae8193f9830e1ebef59cbe",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config.py",
"request_line": "GET \/config.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config.py HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/config.py",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config.py",
"request_line": "GET \/config.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/config.py",
"evidence_snippet": "GET \/config.py HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3000 · (reconnaissance) · → /secrets.py
|
Élevée
|
Moyen · 48
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /secrets.py UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
http_k8s_probe
net_web_probe
Cible HTTP
GET
/secrets.py
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/secrets.py
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Moyen
· 48
Confiance : Confiance 52 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /secrets.py HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /secrets.py HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.
Requête brute (extrait)
GET /secrets.py HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "py",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "1a8bc8321f35e4f1b278130178bc732af3dd3e26",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 208,
"payload_entropy": 5.294280453383878,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 60,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 48,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "6ff5492e29ad6590ef854f0039e2a9d00cc4380c",
"event_fingerprint": "25ff4732fd8616b1c9bc7c5d49a55db9d177aabd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 48
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "923caf97480dac007981b01c7e00fbab",
"path_pattern_hash": "5069867a23cb6033af4025098b5ffa70"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "GET \/secrets.py HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"method": "GET",
"path": "\/secrets.py",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/secrets.py HTTP\/1.1",
"request_sample": "GET \/secrets.py HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/secrets.py HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/secrets.py",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/secrets.py HTTP\/1.1",
"request_sample": "GET \/secrets.py HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/secrets.py HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "61f47e02b467bdb19e7029682e1d8b3e399af9ee",
"protocol_details": {
"http_method": "GET",
"http_path": "\/secrets.py",
"request_line": "GET \/secrets.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/secrets.py HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/secrets.py",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 48
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/secrets.py",
"request_line": "GET \/secrets.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/secrets.py",
"evidence_snippet": "GET \/secrets.py HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"http_k8s_probe",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3000 · (reconnaissance) · → /dist/bundle.js
|
Élevée
|
Moyen · 55
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /dist/bundle.js UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/dist/bundle.js
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/dist/bundle.js
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Moyen
· 55
Confiance : Confiance 52 % — 3 tag(s) WAF
Protocole émulé
1
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /dist/bundle.js HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /dist/bundle.js HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/
Requête brute (extrait)
GET /dist/bundle.js HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "js",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "3d397e6fbe672925768a4cfd837b08ea7ca46b1d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 212,
"payload_entropy": 5.3204810536507905,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 84,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 55,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f0c0fe2eec97508d928f553426c540d54db356be",
"event_fingerprint": "833261643ee90a29b784cad5a1dbb5bc481cc57b",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 55
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "ac67eb6251b03f93a19870f3c40c5a01",
"path_pattern_hash": "332be6dcf184549b4552979b3430af1c"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET \/dist\/bundle.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/",
"method": "GET",
"path": "\/dist\/bundle.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/dist\/bundle.js HTTP\/1.1",
"request_sample": "GET \/dist\/bundle.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/dist\/bundle.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/",
"evidence": {
"method": "GET",
"path": "\/dist\/bundle.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/dist\/bundle.js HTTP\/1.1",
"request_sample": "GET \/dist\/bundle.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/dist\/bundle.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "528159ccc2a259bb1988ad800470ad29dbe60869",
"protocol_details": {
"http_method": "GET",
"http_path": "\/dist\/bundle.js",
"request_line": "GET \/dist\/bundle.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/dist\/bundle.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/",
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/dist\/bundle.js",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 55
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/dist\/bundle.js",
"request_line": "GET \/dist\/bundle.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/dist\/bundle.js",
"evidence_snippet": "GET \/dist\/bundle.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Traversal LFI
lfi path traversal · via HTTP:3000 · (tentative d'exploit) · → /build/static/js/main.js
|
Élevée
|
Moyen · 64
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /build/static/js/main.js UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/build/static/js/main.js
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/build/static/js/main.js
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 64
Confiance : Confiance 59 % — 4 tag(s) WAF
Protocole émulé
1
Signaux
CRS-930100-sub
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /build/static/js/main.js HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-14
rce-0
nosqli-3
Payload (extrait)
GET /build/static/js/main.js HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) App
Requête brute (extrait)
GET /build/static/js/main.js HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": "js",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "2fea438411350aaa22eca6b878fcf14f334121cf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 221,
"payload_entropy": 5.318701958201054,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f02e8800c6e00a1ad068d34d4b81544ce061b851",
"event_fingerprint": "8da4e898a78611d76c8dfa9a917ad27fd81610f1",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100-sub"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "6293b9701a130422f0a14e644a9038a6",
"path_pattern_hash": "a790de344aaa577134cce822349757aa"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/build\/static\/js\/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App",
"method": "GET",
"path": "\/build\/static\/js\/main.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/build\/static\/js\/main.js HTTP\/1.1",
"request_sample": "GET \/build\/static\/js\/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/build\/static\/js\/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App",
"evidence": {
"method": "GET",
"path": "\/build\/static\/js\/main.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/build\/static\/js\/main.js HTTP\/1.1",
"request_sample": "GET \/build\/static\/js\/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/build\/static\/js\/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "70ac32d023f962743e2ec2bc74c7d5a3fcba0532",
"protocol_details": {
"http_method": "GET",
"http_path": "\/build\/static\/js\/main.js",
"request_line": "GET \/build\/static\/js\/main.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/build\/static\/js\/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App",
"attack_vector": "lfi path traversal \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/build\/static\/js\/main.js",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/build\/static\/js\/main.js",
"request_line": "GET \/build\/static\/js\/main.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/build\/static\/js\/main.js",
"evidence_snippet": "GET \/build\/static\/js\/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3000 · (reconnaissance) · → /assets/index.js
|
Élevée
|
Moyen · 56
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /assets/index.js UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_probe_assets
Cible HTTP
GET
/assets/index.js
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/assets/index.js
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Moyen
· 56
Confiance : Confiance 52 % — 3 tag(s) WAF
Protocole émulé
1
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /assets/index.js HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /assets/index.js HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
Requête brute (extrait)
GET /assets/index.js HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "js",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "9eebe336a2dc20ee660c2acfa0bb246dea083a23",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 213,
"payload_entropy": 5.29772233059869,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 84,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 56,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "bd3e961d5f142cf207027322ede21262d05a7958",
"event_fingerprint": "32b7b01faee04110ba9a217d985c27fca8a3d64f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 56
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "b58afca337c6d29ef7e4c8398c47c1f1",
"path_pattern_hash": "9e60e5bb2469a898889ab9e9a9ffce83"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/assets\/index.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"method": "GET",
"path": "\/assets\/index.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/assets\/index.js HTTP\/1.1",
"request_sample": "GET \/assets\/index.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/assets\/index.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"evidence": {
"method": "GET",
"path": "\/assets\/index.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/assets\/index.js HTTP\/1.1",
"request_sample": "GET \/assets\/index.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/assets\/index.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0c2dcf84856e52c33ec360f28bb89a39729c98c8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/assets\/index.js",
"request_line": "GET \/assets\/index.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/assets\/index.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/assets\/index.js",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 56
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/assets\/index.js",
"request_line": "GET \/assets\/index.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/assets\/index.js",
"evidence_snippet": "GET \/assets\/index.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_assets",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3000 · (reconnaissance) · → /assets/app.js
|
Élevée
|
Moyen · 56
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /assets/app.js UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_probe_assets
Cible HTTP
GET
/assets/app.js
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/assets/app.js
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Moyen
· 56
Confiance : Confiance 52 % — 3 tag(s) WAF
Protocole émulé
1
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /assets/app.js HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /assets/app.js HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/5
Requête brute (extrait)
GET /assets/app.js HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "js",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "f8c592422502488e2194b5b344edf33ad4b8757b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 211,
"payload_entropy": 5.291626544566825,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 84,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 56,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "bd3e961d5f142cf207027322ede21262d05a7958",
"event_fingerprint": "042e9bf06eb250ca677cb0c9be944afff4061d6a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 56
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "de37b00d14afd0af7a35861c3c4b1797",
"path_pattern_hash": "a5b9c872c9539a7390bbf552d50689cd"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/assets\/app.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"method": "GET",
"path": "\/assets\/app.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/assets\/app.js HTTP\/1.1",
"request_sample": "GET \/assets\/app.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/assets\/app.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"evidence": {
"method": "GET",
"path": "\/assets\/app.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/assets\/app.js HTTP\/1.1",
"request_sample": "GET \/assets\/app.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/assets\/app.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2cc5e2e59887433ca7b97dc2e254f294098e739e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/assets\/app.js",
"request_line": "GET \/assets\/app.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/assets\/app.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/assets\/app.js",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 56
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/assets\/app.js",
"request_line": "GET \/assets\/app.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/assets\/app.js",
"evidence_snippet": "GET \/assets\/app.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_assets",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3000 · (reconnaissance) · → /vendor.js
|
Élevée
|
Moyen · 47
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /vendor.js UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/vendor.js
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/vendor.js
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Moyen
· 47
Confiance : Confiance 52 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /vendor.js HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /vendor.js HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3
Requête brute (extrait)
GET /vendor.js HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "js",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "316afc872612db004e32c0c28eb31fa0ffa9d99f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 207,
"payload_entropy": 5.3215098158509155,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 60,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 47,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "23a9ef5c72f78da81056c29dd5967bab89d31d6d",
"event_fingerprint": "8dfc61b01c341f74b6c9da0632436cee8f115c50",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "7c83002571d90695eb581eddcc6df344",
"path_pattern_hash": "f35dd6fdee49d3b9a2bf908182db17ec"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/vendor.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"method": "GET",
"path": "\/vendor.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/vendor.js HTTP\/1.1",
"request_sample": "GET \/vendor.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/vendor.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"evidence": {
"method": "GET",
"path": "\/vendor.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/vendor.js HTTP\/1.1",
"request_sample": "GET \/vendor.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/vendor.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "879acd7c4b646b78fea0a30c4ae4e0162beb8d76",
"protocol_details": {
"http_method": "GET",
"http_path": "\/vendor.js",
"request_line": "GET \/vendor.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/vendor.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/vendor.js",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/vendor.js",
"request_line": "GET \/vendor.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/vendor.js",
"evidence_snippet": "GET \/vendor.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Traversal LFI
lfi path traversal · via HTTP:3000 · (tentative d'exploit) · → /static/js/main.js
|
Élevée
|
Élevé · 65
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /static/js/main.js UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/static/js/main.js
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/static/js/main.js
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Élevé
· 65
Confiance : Confiance 59 % — 4 tag(s) WAF
Protocole émulé
1
Signaux
CRS-930100-sub
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /static/js/main.js HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-14
rce-0
nosqli-3
Payload (extrait)
GET /static/js/main.js HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebK
Requête brute (extrait)
GET /static/js/main.js HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "js",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "fc1209930d53479f9de40769306d0e03c0e12113",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 215,
"payload_entropy": 5.299758959071333,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 65,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "a3a5d513b23460130a25b64dfecaf28ae9be1a61",
"event_fingerprint": "3bbd9d43d4dc57496751eb4de3b6b3d88e62ac1f",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100-sub"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "0a758a1be82b2b359fdeb34e6718a987",
"path_pattern_hash": "d7eccad93f9f7ba9883784f3d98302b8"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/static\/js\/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebK",
"method": "GET",
"path": "\/static\/js\/main.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/static\/js\/main.js HTTP\/1.1",
"request_sample": "GET \/static\/js\/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/static\/js\/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebK",
"evidence": {
"method": "GET",
"path": "\/static\/js\/main.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/static\/js\/main.js HTTP\/1.1",
"request_sample": "GET \/static\/js\/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/static\/js\/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebK",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "66a2128799892a417f8a0208f546547ddf10b61c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/static\/js\/main.js",
"request_line": "GET \/static\/js\/main.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/static\/js\/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebK",
"attack_vector": "lfi path traversal \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/static\/js\/main.js",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/static\/js\/main.js",
"request_line": "GET \/static\/js\/main.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/static\/js\/main.js",
"evidence_snippet": "GET \/static\/js\/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebK",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_static",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Traversal LFI
lfi path traversal · via HTTP:3000 · (tentative d'exploit) · → /static/js/app.js
|
Élevée
|
Élevé · 65
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /static/js/app.js UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/static/js/app.js
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/static/js/app.js
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Élevé
· 65
Confiance : Confiance 59 % — 4 tag(s) WAF
Protocole émulé
1
Signaux
CRS-930100-sub
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /static/js/app.js HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-14
rce-0
nosqli-3
Payload (extrait)
GET /static/js/app.js HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi
Requête brute (extrait)
GET /static/js/app.js HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "js",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "2e8487d6ca226d333a0e0e427de3a57a117c9672",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 214,
"payload_entropy": 5.29942490709921,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 65,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "a3a5d513b23460130a25b64dfecaf28ae9be1a61",
"event_fingerprint": "34d03a1aca4323d9756037b55e1bc0b6752ecf16",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100-sub"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "607ba54cf9899df9fd661739285083bd",
"path_pattern_hash": "02ccc7d3f44ece92b2d30ec0bac374d7"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/static\/js\/app.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
"method": "GET",
"path": "\/static\/js\/app.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/static\/js\/app.js HTTP\/1.1",
"request_sample": "GET \/static\/js\/app.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/static\/js\/app.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
"evidence": {
"method": "GET",
"path": "\/static\/js\/app.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/static\/js\/app.js HTTP\/1.1",
"request_sample": "GET \/static\/js\/app.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/static\/js\/app.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "30a9121736e8b93150461e50bc7899228e15ac4e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/static\/js\/app.js",
"request_line": "GET \/static\/js\/app.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/static\/js\/app.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
"attack_vector": "lfi path traversal \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/static\/js\/app.js",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/static\/js\/app.js",
"request_line": "GET \/static\/js\/app.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/static\/js\/app.js",
"evidence_snippet": "GET \/static\/js\/app.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_static",
"net_web_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3000 · (reconnaissance) · → /dist/main.js
|
Élevée
|
Moyen · 55
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /dist/main.js UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/dist/main.js
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/dist/main.js
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Moyen
· 55
Confiance : Confiance 52 % — 3 tag(s) WAF
Protocole émulé
1
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /dist/main.js HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /dist/main.js HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53
Requête brute (extrait)
GET /dist/main.js HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "js",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "a207d7eb5fb0981149fd0c78299aa17c839e981c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 210,
"payload_entropy": 5.307973500294161,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 84,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 55,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f0c0fe2eec97508d928f553426c540d54db356be",
"event_fingerprint": "0531e4fcf155d8859200949dbbed785d902abd9c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 55
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "11136ca1092df8467401aeb645b95264",
"path_pattern_hash": "ed890272e7383054c69c77a023519696"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET \/dist\/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"method": "GET",
"path": "\/dist\/main.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/dist\/main.js HTTP\/1.1",
"request_sample": "GET \/dist\/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/dist\/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"evidence": {
"method": "GET",
"path": "\/dist\/main.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/dist\/main.js HTTP\/1.1",
"request_sample": "GET \/dist\/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/dist\/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "972da7fc5b710dd2232578ed210c212f6e61c0ac",
"protocol_details": {
"http_method": "GET",
"http_path": "\/dist\/main.js",
"request_line": "GET \/dist\/main.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/dist\/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/dist\/main.js",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 84,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 55
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/dist\/main.js",
"request_line": "GET \/dist\/main.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/dist\/main.js",
"evidence_snippet": "GET \/dist\/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3000 · (reconnaissance) · → /server.js
|
Élevée
|
Moyen · 47
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /server.js UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/server.js
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/server.js
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Moyen
· 47
Confiance : Confiance 52 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /server.js HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /server.js HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3
Requête brute (extrait)
GET /server.js HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "js",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "9d9a790905bbaa9bf7477bf649ea86123ade8583",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 207,
"payload_entropy": 5.312792218049401,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 60,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 47,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "23a9ef5c72f78da81056c29dd5967bab89d31d6d",
"event_fingerprint": "d150cf1d9411671f0d1d614b7bf132dfe8993692",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "364db2d1958f6967e76e7f61bd5cf0c7",
"path_pattern_hash": "10460208544c084cff624f51fd25d0f9"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/server.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"method": "GET",
"path": "\/server.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/server.js HTTP\/1.1",
"request_sample": "GET \/server.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/server.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"evidence": {
"method": "GET",
"path": "\/server.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/server.js HTTP\/1.1",
"request_sample": "GET \/server.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/server.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1dc05ce3da6ec0ddc075e4d0bfc693eaf96f7f5a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server.js",
"request_line": "GET \/server.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/server.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/server.js",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/server.js",
"request_line": "GET \/server.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/server.js",
"evidence_snippet": "GET \/server.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3000 · (reconnaissance) · → /bundle.js
|
Élevée
|
Moyen · 47
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /bundle.js UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/bundle.js
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/bundle.js
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Moyen
· 47
Confiance : Confiance 52 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /bundle.js HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /bundle.js HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3
Requête brute (extrait)
GET /bundle.js HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "js",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "5c28bc6707fadbc1c6dacdabca89ac4afb276d6a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 207,
"payload_entropy": 5.320902583874718,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 60,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 47,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "23a9ef5c72f78da81056c29dd5967bab89d31d6d",
"event_fingerprint": "8e25e5fd0656e2153b39710a65e016696542e81a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "699792258e778938264c59e83221c917",
"path_pattern_hash": "59bff92e27ba3df61892a035edfe8dbf"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/bundle.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"method": "GET",
"path": "\/bundle.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/bundle.js HTTP\/1.1",
"request_sample": "GET \/bundle.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/bundle.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"evidence": {
"method": "GET",
"path": "\/bundle.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/bundle.js HTTP\/1.1",
"request_sample": "GET \/bundle.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/bundle.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f543dfe174237ebd585d7fa5156c11e652cea7a4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/bundle.js",
"request_line": "GET \/bundle.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/bundle.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/bundle.js",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/bundle.js",
"request_line": "GET \/bundle.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/bundle.js",
"evidence_snippet": "GET \/bundle.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3000 · (reconnaissance) · → /app.bundle.js
|
Élevée
|
Moyen · 47
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /app.bundle.js UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/app.bundle.js
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/app.bundle.js
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Moyen
· 47
Confiance : Confiance 52 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /app.bundle.js HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /app.bundle.js HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/5
Requête brute (extrait)
GET /app.bundle.js HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "js",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "0af46f5a2803132335577023b795bcd61e1c7dba",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 211,
"payload_entropy": 5.318416633400851,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 60,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 47,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "23a9ef5c72f78da81056c29dd5967bab89d31d6d",
"event_fingerprint": "3b0717d9e60fc4e75aa2901f40095bd6caad21a8",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "f50e489487bf5cc6d44a1e29ad5f79de",
"path_pattern_hash": "dbac0f56de5385be27bb738f2b1ee1a3"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/app.bundle.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"method": "GET",
"path": "\/app.bundle.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/app.bundle.js HTTP\/1.1",
"request_sample": "GET \/app.bundle.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/app.bundle.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"evidence": {
"method": "GET",
"path": "\/app.bundle.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/app.bundle.js HTTP\/1.1",
"request_sample": "GET \/app.bundle.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/app.bundle.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bf530229c0760d4e88ae2c93cc3e4b4bcce029c2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app.bundle.js",
"request_line": "GET \/app.bundle.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/app.bundle.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/app.bundle.js",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/app.bundle.js",
"request_line": "GET \/app.bundle.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/app.bundle.js",
"evidence_snippet": "GET \/app.bundle.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3000 · (reconnaissance) · → /main.bundle.js
|
Élevée
|
Moyen · 47
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /main.bundle.js UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/main.bundle.js
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/main.bundle.js
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Moyen
· 47
Confiance : Confiance 52 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /main.bundle.js HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /main.bundle.js HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/
Requête brute (extrait)
GET /main.bundle.js HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "js",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "62b8af91235b91d92c321592c9d4f9b0f26f8be3",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 212,
"payload_entropy": 5.3184473541454755,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 60,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 47,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "23a9ef5c72f78da81056c29dd5967bab89d31d6d",
"event_fingerprint": "1da701629b6c2f9494e934cc5d1f2133094d0ac1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "8237f17559e3587bf4b8c274d2283043",
"path_pattern_hash": "656f2faabb66b2f56a51454a38dd35c2"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/main.bundle.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/",
"method": "GET",
"path": "\/main.bundle.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/main.bundle.js HTTP\/1.1",
"request_sample": "GET \/main.bundle.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/main.bundle.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/",
"evidence": {
"method": "GET",
"path": "\/main.bundle.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/main.bundle.js HTTP\/1.1",
"request_sample": "GET \/main.bundle.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/main.bundle.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a6902f7741259bec6bb83c5951631dcb8c0ffb8e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/main.bundle.js",
"request_line": "GET \/main.bundle.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/main.bundle.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/",
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/main.bundle.js",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/main.bundle.js",
"request_line": "GET \/main.bundle.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/main.bundle.js",
"evidence_snippet": "GET \/main.bundle.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:3000 · (tentative d'exploit) · → /settings.json
|
Élevée
|
Moyen · 49
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /settings.json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/settings.json
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/settings.json
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 49
Confiance : Confiance 62 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /settings.json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /settings.json HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/5
Requête brute (extrait)
GET /settings.json HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "json",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "bf7030628c229b3e041c7e1c251921a9918e64a1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 211,
"payload_entropy": 5.292023952335102,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 60,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 49,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b6eec39e24df18329c920374a0bd44f90e085b9a",
"event_fingerprint": "3c1d413eb5c3c6991029d8dcbf681ea6a5584b30",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 49
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "fa71d3c53fb2aaf2067ab2603d403541",
"path_pattern_hash": "77c44ac5d0e9de12fccd3bb6237f7ba5"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 49
},
"payload_preview": "GET \/settings.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"method": "GET",
"path": "\/settings.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/settings.json HTTP\/1.1",
"request_sample": "GET \/settings.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/settings.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"evidence": {
"method": "GET",
"path": "\/settings.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/settings.json HTTP\/1.1",
"request_sample": "GET \/settings.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/settings.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ca2d02b35cc27bdee7ed321977e3f95f56430e4c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/settings.json",
"request_line": "GET \/settings.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/settings.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"attack_vector": "exploit attempt \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/settings.json",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 49
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 49,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/settings.json",
"request_line": "GET \/settings.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/settings.json",
"evidence_snippet": "GET \/settings.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Sonde fichier credential / clé
credential file probe · via HTTP:3000 · (tentative d'exploit) · → /secrets.json
|
Élevée
|
Moyen · 57
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /secrets.json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
http_k8s_probe
net_web_probe
Cible HTTP
GET
/secrets.json
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/secrets.json
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « rce-0 » · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 57
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
pat-0496
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Secrets JSON file
Ligne de requête
GET /secrets.json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /secrets.json HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53
Requête brute (extrait)
GET /secrets.json HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "json",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "9906f032745691753325e07cb911e68c17846b5d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 210,
"payload_entropy": 5.285441905833753,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 60,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 60,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 57,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "6ff5492e29ad6590ef854f0039e2a9d00cc4380c",
"event_fingerprint": "8457a77529f0a195ab53c9adaa14ac5fdfdfb86c",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 135,
"precision_signals": [
"pat-0496",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"pat-0496",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0496"
],
"matched_pattern_names": [
"Cred Secrets JSON file"
],
"pattern_ids": [
"pat-0496"
],
"confidence_breakdown": {
"waf": 60,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 57
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "2780078b98dc9580a7d21227f7b8a72a",
"path_pattern_hash": "1abd330c58113f23df400bb25a78bd81"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 57
},
"payload_preview": "GET \/secrets.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"method": "GET",
"path": "\/secrets.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/secrets.json HTTP\/1.1",
"request_sample": "GET \/secrets.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/secrets.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"evidence": {
"method": "GET",
"path": "\/secrets.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/secrets.json HTTP\/1.1",
"request_sample": "GET \/secrets.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/secrets.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0cc5d5687f4f12017709d1cc8c2647d5036a9fd0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/secrets.json",
"request_line": "GET \/secrets.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/secrets.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"attack_vector": "credential file probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/secrets.json",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 57
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 57,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"pat-0496",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"pat-0496",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/secrets.json",
"request_line": "GET \/secrets.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/secrets.json",
"evidence_snippet": "GET \/secrets.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"http_k8s_probe",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Sonde fichier credential / clé
credential file probe · via HTTP:3000 · (tentative d'exploit) · → /credentials.json
|
Élevée
|
Moyen · 56
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /credentials.json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/credentials.json
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/credentials.json
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « rce-0 » · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 56
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
pat-0472
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Credentials JSON
Ligne de requête
GET /credentials.json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /credentials.json HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi
Requête brute (extrait)
GET /credentials.json HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "json",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "52ce12cd9608e2aaf265869963eb9ccc97689fda",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 214,
"payload_entropy": 5.290979373383879,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 60,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 56,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a2464605ab8f4dbb4bbdcd29e38b4c83350e5eb7",
"event_fingerprint": "2df63002dd2b4e428bf187078321e04b81a9c633",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 135,
"precision_signals": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0472"
],
"matched_pattern_names": [
"Cred Credentials JSON"
],
"pattern_ids": [
"pat-0472"
],
"confidence_breakdown": {
"waf": 60,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 56
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "979e4bcc74c7ba7819ebbc1fc2ae926e",
"path_pattern_hash": "2c897236c88b33a0e02927235471c8c3"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
"method": "GET",
"path": "\/credentials.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/credentials.json HTTP\/1.1",
"request_sample": "GET \/credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
"evidence": {
"method": "GET",
"path": "\/credentials.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/credentials.json HTTP\/1.1",
"request_sample": "GET \/credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f7458f42f94e45e007d4f4e3597ec26ab0d47084",
"protocol_details": {
"http_method": "GET",
"http_path": "\/credentials.json",
"request_line": "GET \/credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
"attack_vector": "credential file probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/credentials.json",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 56
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"pat-0472",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/credentials.json",
"request_line": "GET \/credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/credentials.json",
"evidence_snippet": "GET \/credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3000 · (reconnaissance) · → /app.js
|
Élevée
|
Moyen · 47
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /app.js UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/app.js
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/app.js
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Moyen
· 47
Confiance : Confiance 52 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /app.js HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /app.js HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (
Requête brute (extrait)
GET /app.js HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "js",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "3c179370f0c2d0a7e227f65dd60b7b4aa8a5177f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 204,
"payload_entropy": 5.3047609203717245,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 60,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 47,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "23a9ef5c72f78da81056c29dd5967bab89d31d6d",
"event_fingerprint": "33fcf4d629d6f6cc0041ba2e81748095623c40d9",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "78c8c4026fb397134dfdeb1ef85ae783",
"path_pattern_hash": "d5e8a067e9f2ac7b37dd1c869137e3f0"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/app.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"method": "GET",
"path": "\/app.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/app.js HTTP\/1.1",
"request_sample": "GET \/app.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/app.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"evidence": {
"method": "GET",
"path": "\/app.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/app.js HTTP\/1.1",
"request_sample": "GET \/app.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/app.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8b9f0791f8fe7049dbe9f81e8f0bdac5c41604b0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app.js",
"request_line": "GET \/app.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/app.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/app.js",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/app.js",
"request_line": "GET \/app.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/app.js",
"evidence_snippet": "GET \/app.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3000 · (reconnaissance) · → /main.js
|
Élevée
|
Moyen · 47
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /main.js UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/main.js
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/main.js
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Moyen
· 47
Confiance : Confiance 52 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /main.js HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /main.js HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Requête brute (extrait)
GET /main.js HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "js",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "e46ea72cce1cadb614d3abac8b75f00e6bad53c9",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 205,
"payload_entropy": 5.305631250579817,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 60,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 47,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "23a9ef5c72f78da81056c29dd5967bab89d31d6d",
"event_fingerprint": "f8238470ba12dede4e2319171d891cac1576303b",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "28ec777de07ad910076a957a1ace23c8",
"path_pattern_hash": "6767bab1fbcedbc82a67330f1c9f7602"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 ",
"method": "GET",
"path": "\/main.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/main.js HTTP\/1.1",
"request_sample": "GET \/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"evidence": {
"method": "GET",
"path": "\/main.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/main.js HTTP\/1.1",
"request_sample": "GET \/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2bb4919231eae9336429b9d9a4dc1a699749d687",
"protocol_details": {
"http_method": "GET",
"http_path": "\/main.js",
"request_line": "GET \/main.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/main.js",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 60,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 47
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/main.js",
"request_line": "GET \/main.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/main.js",
"evidence_snippet": "GET \/main.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:3000 · (tentative d'exploit) · → /docker-compose.prod.yml
|
Élevée
|
Moyen · 49
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /docker-compose.prod.yml UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/docker-compose.prod.yml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/docker-compose.prod.yml
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 49
Confiance : Confiance 62 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /docker-compose.prod.yml HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /docker-compose.prod.yml HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) App
Requête brute (extrait)
GET /docker-compose.prod.yml HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yml",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "e0f4d8c475ba7860adfbc6fce1ef729836b642b1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 221,
"payload_entropy": 5.314965148185977,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 60,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 49,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "23a9ef5c72f78da81056c29dd5967bab89d31d6d",
"event_fingerprint": "bf82496a43a2bbd3c821c44694ad8e3349fbaffd",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 49
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "c731f7ee7ffd9b6de17ca8ac7c2156dc",
"path_pattern_hash": "34e7c48d3a24d0769f43576d3e67ea74"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 49
},
"payload_preview": "GET \/docker-compose.prod.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App",
"method": "GET",
"path": "\/docker-compose.prod.yml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/docker-compose.prod.yml HTTP\/1.1",
"request_sample": "GET \/docker-compose.prod.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/docker-compose.prod.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App",
"evidence": {
"method": "GET",
"path": "\/docker-compose.prod.yml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/docker-compose.prod.yml HTTP\/1.1",
"request_sample": "GET \/docker-compose.prod.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/docker-compose.prod.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0bd59a01951e088674dc32d3c9383aae22a123dc",
"protocol_details": {
"http_method": "GET",
"http_path": "\/docker-compose.prod.yml",
"request_line": "GET \/docker-compose.prod.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/docker-compose.prod.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App",
"attack_vector": "exploit attempt \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/docker-compose.prod.yml",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 49
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 49,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/docker-compose.prod.yml",
"request_line": "GET \/docker-compose.prod.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/docker-compose.prod.yml",
"evidence_snippet": "GET \/docker-compose.prod.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:3000 · (tentative d'exploit) · → /config.js
|
Élevée
|
Moyen · 49
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /config.js UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/config.js
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/config.js
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 49
Confiance : Confiance 62 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /config.js HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /config.js HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3
Requête brute (extrait)
GET /config.js HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "js",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "67b3179b286c960b4be84ff433764afe1a997eeb",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 207,
"payload_entropy": 5.309864184731592,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 60,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 49,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "23a9ef5c72f78da81056c29dd5967bab89d31d6d",
"event_fingerprint": "2e2800f2c8a2c467dcc43a763e53c4aaeb49536d",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 49
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "dd7ba4d57d5210a4fa25381c8b17d4c4",
"path_pattern_hash": "0ad09149f0572f6cdaf5a224970ea0d2"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 49
},
"payload_preview": "GET \/config.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"method": "GET",
"path": "\/config.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config.js HTTP\/1.1",
"request_sample": "GET \/config.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/config.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"evidence": {
"method": "GET",
"path": "\/config.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config.js HTTP\/1.1",
"request_sample": "GET \/config.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/config.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "172dd32d24ce63237d9eab27f2f1570344ef31c4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config.js",
"request_line": "GET \/config.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"attack_vector": "exploit attempt \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config.js",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 49
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 49,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config.js",
"request_line": "GET \/config.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config.js",
"evidence_snippet": "GET \/config.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3000 · (tentative d'exploit) · → /config.json
|
Élevée
|
Moyen · 55
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /config.json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
http_sensitive_path
net_web_probe
Cible HTTP
GET
/config.json
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/config.json
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 55
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
Http Sensitive
pat-0247
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /config.json
Ligne de requête
GET /config.json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /config.json HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537
Requête brute (extrait)
GET /config.json HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "json",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "110dc2bb220538a9df6ea13fd8474a5056c773dc",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 209,
"payload_entropy": 5.303299871581315,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 55,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "6f5fba9a5d894a01c4faeda242a5fb20064d8b1c",
"event_fingerprint": "181b79a84a96ef5b1465b8fa334ccca057ebefc3",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 182,
"precision_signals": [
"INT-http_sensitive",
"pat-0247",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"pat-0247",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0247"
],
"matched_pattern_names": [
"Probe \/config.json"
],
"pattern_ids": [
"pat-0247"
],
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 55
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "0537e59146dc7cffa848a5287389e093",
"path_pattern_hash": "b2ebf86a95e6e198c8d34ea73388c4ce"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET \/config.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"method": "GET",
"path": "\/config.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config.json HTTP\/1.1",
"request_sample": "GET \/config.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/config.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"evidence": {
"method": "GET",
"path": "\/config.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config.json HTTP\/1.1",
"request_sample": "GET \/config.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/config.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0b82dac2f5743a9b6a2fd980adafd1a1ab079738",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config.json",
"request_line": "GET \/config.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"attack_vector": "config file probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config.json",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 55
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-http_sensitive",
"pat-0247",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"pat-0247",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config.json",
"request_line": "GET \/config.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config.json",
"evidence_snippet": "GET \/config.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:3000 · (tentative d'exploit) · → /settings.js
|
Élevée
|
Moyen · 49
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /settings.js UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/settings.js
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/settings.js
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 49
Confiance : Confiance 62 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /settings.js HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /settings.js HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537
Requête brute (extrait)
GET /settings.js HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "js",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "600a07472be074279f73e485903b746a3072d617",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 209,
"payload_entropy": 5.29751686262666,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 60,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 49,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "23a9ef5c72f78da81056c29dd5967bab89d31d6d",
"event_fingerprint": "a485c7ba017ae9a94bb07b2975b345542fa94a4a",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 49
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "00b40a89c5864a72b2e256ef4ae3f2c4",
"path_pattern_hash": "1bfd7de8f2b794aaf55add02ed38d00c"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 49
},
"payload_preview": "GET \/settings.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"method": "GET",
"path": "\/settings.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/settings.js HTTP\/1.1",
"request_sample": "GET \/settings.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/settings.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"evidence": {
"method": "GET",
"path": "\/settings.js",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/settings.js HTTP\/1.1",
"request_sample": "GET \/settings.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/settings.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "760dd961fd0572a261fa16b9227cd29a3458f18c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/settings.js",
"request_line": "GET \/settings.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/settings.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"attack_vector": "exploit attempt \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/settings.js",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 49
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 49,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/settings.js",
"request_line": "GET \/settings.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/settings.js",
"evidence_snippet": "GET \/settings.js HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3000 · (tentative d'exploit) · → /var/.env
|
Élevée
|
Élevé · 70
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /var/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/var/.env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/var/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /var/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /var/.env HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Requête brute (extrait)
GET /var/.env HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "7f1fb2a1c5b72e520b988cd8c8a970a6662732b5",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 206,
"payload_entropy": 5.3024764839342415,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.3,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "9f43f82162d7adf0889172655c4e088993aef2bb",
"event_fingerprint": "6d389585564e5579fd42edfe35d63328425f7ff1",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "4dce9d8a211793b06680f9b1482047bf",
"path_pattern_hash": "0d0f9087dce4407a1a8d5052b0a9d1bf"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/var\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"method": "GET",
"path": "\/var\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/var\/.env HTTP\/1.1",
"request_sample": "GET \/var\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/var\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"evidence": {
"method": "GET",
"path": "\/var\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/var\/.env HTTP\/1.1",
"request_sample": "GET \/var\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/var\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "052e30d673ad29a8ae6e3ccb9091efa64f69928e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/var\/.env",
"request_line": "GET \/var\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/var\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"attack_vector": "config file probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/var\/.env",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/var\/.env",
"request_line": "GET \/var\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/var\/.env",
"evidence_snippet": "GET \/var\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:3000 · (tentative d'exploit) · → /docker-compose.yaml
|
Élevée
|
Moyen · 49
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /docker-compose.yaml UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/docker-compose.yaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/docker-compose.yaml
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 49
Confiance : Confiance 62 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /docker-compose.yaml HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /docker-compose.yaml HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET /docker-compose.yaml HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yaml",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "3bbb8fd589a1c6561445293d25ec31c27a2956aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 217,
"payload_entropy": 5.31734309684801,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 60,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 49,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "23a9ef5c72f78da81056c29dd5967bab89d31d6d",
"event_fingerprint": "d4edbc7ea1e8bbf155c53f1a2fc4999a1f85ff67",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 49
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "f014063e5234642e75a8152eada695de",
"path_pattern_hash": "d91024f4d52a5546d3cddb98775be9d6"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 49
},
"payload_preview": "GET \/docker-compose.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/docker-compose.yaml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/docker-compose.yaml HTTP\/1.1",
"request_sample": "GET \/docker-compose.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/docker-compose.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/docker-compose.yaml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/docker-compose.yaml HTTP\/1.1",
"request_sample": "GET \/docker-compose.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/docker-compose.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "074fc581abfdf95e845536a928066896a0d3458d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/docker-compose.yaml",
"request_line": "GET \/docker-compose.yaml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/docker-compose.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "exploit attempt \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/docker-compose.yaml",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 49
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 49,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/docker-compose.yaml",
"request_line": "GET \/docker-compose.yaml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/docker-compose.yaml",
"evidence_snippet": "GET \/docker-compose.yaml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:3000 · (tentative d'exploit) · → /docker-compose.override.yml
|
Élevée
|
Moyen · 49
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /docker-compose.override.yml UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/docker-compose.override.yml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/docker-compose.override.yml
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 49
Confiance : Confiance 62 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /docker-compose.override.yml HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /docker-compose.override.yml HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Requête brute (extrait)
GET /docker-compose.override.yml HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yml",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "d8b1323b6ef8c906588c7bebedb55eb8820ae5d1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 225,
"payload_entropy": 5.318485207316557,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 60,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 49,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "23a9ef5c72f78da81056c29dd5967bab89d31d6d",
"event_fingerprint": "629f2a64059057b9c72e1b6506c76f7da8cd43e7",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 49
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "c8ad5e08cf1ec78da4671c59c2945ca1",
"path_pattern_hash": "eaee3b34be9f0e8721a1e0c8de81e82c"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 49
},
"payload_preview": "GET \/docker-compose.override.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)",
"method": "GET",
"path": "\/docker-compose.override.yml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/docker-compose.override.yml HTTP\/1.1",
"request_sample": "GET \/docker-compose.override.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/docker-compose.override.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)",
"evidence": {
"method": "GET",
"path": "\/docker-compose.override.yml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/docker-compose.override.yml HTTP\/1.1",
"request_sample": "GET \/docker-compose.override.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/docker-compose.override.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "583dfcf073f709aeff11890a789b54faed2fa43f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/docker-compose.override.yml",
"request_line": "GET \/docker-compose.override.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/docker-compose.override.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)",
"attack_vector": "exploit attempt \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/docker-compose.override.yml",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 49
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 49,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/docker-compose.override.yml",
"request_line": "GET \/docker-compose.override.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/docker-compose.override.yml",
"evidence_snippet": "GET \/docker-compose.override.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:3000 · (tentative d'exploit) · → /docker-compose.dev.yml
|
Élevée
|
Moyen · 49
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /docker-compose.dev.yml UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/docker-compose.dev.yml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/docker-compose.dev.yml
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 49
Confiance : Confiance 62 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /docker-compose.dev.yml HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /docker-compose.dev.yml HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl
Requête brute (extrait)
GET /docker-compose.dev.yml HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yml",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "7ee3e2436a44816af2348c3ec543a3fd946c2f9e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 220,
"payload_entropy": 5.3294494814743505,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 60,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 49,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "23a9ef5c72f78da81056c29dd5967bab89d31d6d",
"event_fingerprint": "c3d0e611db51da236f3886a4c1e8237bcf61fc27",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 49
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "a7a93b4903be66b8865a8caacc42fa14",
"path_pattern_hash": "44551548ed702b85048d052da6b4f350"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 49
},
"payload_preview": "GET \/docker-compose.dev.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
"method": "GET",
"path": "\/docker-compose.dev.yml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/docker-compose.dev.yml HTTP\/1.1",
"request_sample": "GET \/docker-compose.dev.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/docker-compose.dev.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
"evidence": {
"method": "GET",
"path": "\/docker-compose.dev.yml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/docker-compose.dev.yml HTTP\/1.1",
"request_sample": "GET \/docker-compose.dev.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/docker-compose.dev.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "317f9cefb07464c910d552622d431436edf6bd74",
"protocol_details": {
"http_method": "GET",
"http_path": "\/docker-compose.dev.yml",
"request_line": "GET \/docker-compose.dev.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/docker-compose.dev.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
"attack_vector": "exploit attempt \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/docker-compose.dev.yml",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 49
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 49,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/docker-compose.dev.yml",
"request_line": "GET \/docker-compose.dev.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/docker-compose.dev.yml",
"evidence_snippet": "GET \/docker-compose.dev.yml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3000 · (tentative d'exploit) · → /frontend/.env
|
Élevée
|
Élevé · 70
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /frontend/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/frontend/.env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/frontend/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /frontend/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /frontend/.env HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/5
Requête brute (extrait)
GET /frontend/.env HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "77987435bb3ae079ceddf1be0ca83f10bd79e60f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 211,
"payload_entropy": 5.297014256553198,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.3,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "9f43f82162d7adf0889172655c4e088993aef2bb",
"event_fingerprint": "c88c78b51a9c40ae36cd0746db04bac4018fd813",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "2dcfa58bb078878bdf7c13aadeeff59e",
"path_pattern_hash": "2eb92b74c9200f7bfafce81d1b6d362c"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/frontend\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"method": "GET",
"path": "\/frontend\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env HTTP\/1.1",
"request_sample": "GET \/frontend\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/frontend\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"evidence": {
"method": "GET",
"path": "\/frontend\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env HTTP\/1.1",
"request_sample": "GET \/frontend\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/frontend\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3acc39ba60b3c460136a5da6d92799c46772b0d9",
"protocol_details": {
"http_method": "GET",
"http_path": "\/frontend\/.env",
"request_line": "GET \/frontend\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/frontend\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"attack_vector": "config file probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/frontend\/.env",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/frontend\/.env",
"request_line": "GET \/frontend\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/frontend\/.env",
"evidence_snippet": "GET \/frontend\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/5",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3000 · (tentative d'exploit) · → /api/.env
|
Élevée
|
Élevé · 70
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /api/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
31
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/api/.env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/api/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /api/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
k8s-api
Payload (extrait)
GET /api/.env HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Requête brute (extrait)
GET /api/.env HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "f5b7d21cf92d5caca6cd906725e72730e31bc18c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 206,
"payload_entropy": 5.291075923033286,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.8,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 9,
"anomaly_count": 0,
"campaign_key": "cd64ea473e0ffd91c176875e6abef82e175e4005",
"event_fingerprint": "423322bca97965f81f677f5a1f831a2a9f1170cf",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "d85a4ba8fe76baf62626498cdfe09604",
"path_pattern_hash": "3c658e3b68f996f41891a76e1d05a9a5"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/api\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"method": "GET",
"path": "\/api\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"950600:k8s-api"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1",
"k8s-api"
],
"request_line": "GET \/api\/.env HTTP\/1.1",
"request_sample": "GET \/api\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/api\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"evidence": {
"method": "GET",
"path": "\/api\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"950600:k8s-api"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1",
"k8s-api"
],
"request_line": "GET \/api\/.env HTTP\/1.1",
"request_sample": "GET \/api\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/api\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5088fa9285376abac1e335ed4a5472486ba22e73",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/.env",
"request_line": "GET \/api\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"attack_vector": "config file probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.env",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/.env",
"request_line": "GET \/api\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.env",
"evidence_snippet": "GET \/api\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"950600:k8s-api",
"http_backup_file_scan",
"http_probe_api",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:3000 · (tentative d'exploit) · → /client/.env
|
Élevée
|
Élevé · 70
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /client/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/client/.env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/client/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /client/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /client/.env HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537
Requête brute (extrait)
GET /client/.env HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:3000
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "aa094ac9b0963fceefe47f51ee0dc734bd299416",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 209,
"payload_entropy": 5.278801631189704,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 14618,
"country": "US",
"dst_port": 3000,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.3,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "9f43f82162d7adf0889172655c4e088993aef2bb",
"event_fingerprint": "c39d35e4ef5d775d2bfc6d147fa58c99ac6a4784",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14618,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "bbc226551b8e5f51eca93a8f047f9395",
"path_pattern_hash": "e9186ae330a383b32843f25c5a42904b"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/client\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"method": "GET",
"path": "\/client\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/client\/.env HTTP\/1.1",
"request_sample": "GET \/client\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/client\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"evidence": {
"method": "GET",
"path": "\/client\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/client\/.env HTTP\/1.1",
"request_sample": "GET \/client\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:3000\r\n\r\n",
"payload_snippet": "GET \/client\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a66a18718e80eabf3884fea1b0de149c715534ff",
"protocol_details": {
"http_method": "GET",
"http_path": "\/client\/.env",
"request_line": "GET \/client\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/client\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"attack_vector": "config file probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/client\/.env",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/client\/.env",
"request_line": "GET \/client\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/client\/.env",
"evidence_snippet": "GET \/client\/.env HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|