15/06/2026 12:49:57 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /system/application/config/database.php
Élevée
Moyen · 62
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /system/application/config/database.php UA Mozilla/5.0 (Linux; U; Android 8.1.0; zh-CN; EML-AL00 Build/HUA…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/system/application/config/database.php
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/system/application/config/database.php
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 62
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /system/application/config/database.php HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; U; Android 8.1.0; zh-CN; EML-AL00 Build/HUAWEIEML-AL00) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 baidu.sogo.uc.UCBrowser/11.9.4.974 UWS/2.13.1.48 Mo…
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /system/application/config/database.php HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (Linux; U; Android 8.1.0; z
Requête brute (extrait)
GET /system/application/config/database.php HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (Linux; U; Android 8.1.0; zh-CN; EML-AL00 Build/HUAWEIEML-AL00) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 baidu.sogo.uc.UCBro
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": "php",
"http_ua_hash": "a0d4576af53f87cdc2baaa057d0330388196a422",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "24e56dc80b8c9895dd6363dc3d163c6ca2669cf7",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 464,
"payload_entropy": 5.505934885767479,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 62,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4e9ee6c02a5943d02ed1fdefbaf390ad3389e177",
"event_fingerprint": "117efe28c29c2b9f60154200e67b08de2a049910",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e4eece6ef0a41f0fb3516b5bbe27e9f6",
"payload_hash": "52bcd0fd1c8862d46e321ec4e6e7292c",
"path_pattern_hash": "70f588a640b3de59a5428f938c259cab"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 62
},
"payload_preview": "GET \/system\/application\/config\/database.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 8.1.0; z",
"method": "GET",
"path": "\/system\/application\/config\/database.php",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 8.1.0; zh-CN; EML-AL00 Build\/HUAWEIEML-AL00) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/57.0.2987.108 baidu.sogo.uc.UCBrowser\/11.9.4.974 UWS\/2.13.1.48 Mobile Safari\/537.36 AliApp(DingTalk\/4.5.11) com.alibaba.a\u2026",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/system\/application\/config\/database.php HTTP\/1.1",
"request_sample": "GET \/system\/application\/config\/database.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 8.1.0; zh-CN; EML-AL00 Build\/HUAWEIEML-AL00) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/57.0.2987.108 baidu.sogo.uc.UCBro",
"payload_snippet": "GET \/system\/application\/config\/database.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 8.1.0; z",
"evidence": {
"method": "GET",
"path": "\/system\/application\/config\/database.php",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 8.1.0; zh-CN; EML-AL00 Build\/HUAWEIEML-AL00) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/57.0.2987.108 baidu.sogo.uc.UCBrowser\/11.9.4.974 UWS\/2.13.1.48 Mobile Safari\/537.36 AliApp(DingTalk\/4.5.11) com.alibaba.a\u2026",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/system\/application\/config\/database.php HTTP\/1.1",
"request_sample": "GET \/system\/application\/config\/database.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 8.1.0; zh-CN; EML-AL00 Build\/HUAWEIEML-AL00) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/57.0.2987.108 baidu.sogo.uc.UCBro",
"payload_snippet": "GET \/system\/application\/config\/database.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 8.1.0; z",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "acf1fe83ddda30f8ddd02f16e51021eac1ee2f26",
"protocol_details": {
"http_method": "GET",
"http_path": "\/system\/application\/config\/database.php",
"request_line": "GET \/system\/application\/config\/database.php HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 8.1.0; zh-CN; EML-AL00 Build\/HUAWEIEML-AL00) AppleWebKit\/537.36 (KHTML, like Gecko) Vers\u2026",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/system\/application\/config\/database.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 8.1.0; z",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/system\/application\/config\/database.php",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 62,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/system\/application\/config\/database.php",
"request_line": "GET \/system\/application\/config\/database.php HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 8.1.0; zh-CN; EML-AL00 Build\/HUAWEIEML-AL00) AppleWebKit\/537.36 (KHTML, like Gecko) Vers\u2026",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/system\/application\/config\/database.php",
"evidence_snippet": "GET \/system\/application\/config\/database.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 8.1.0; z",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:57 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /internal/config.yml
Élevée
Moyen · 63
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /internal/config.yml UA Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20100101 Firefox/…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_probe_internal
Cible HTTP
GET
/internal/config.yml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/internal/config.yml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 63
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /internal/config.yml HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20100101 Firefox/5.0 Iceweasel/5.0
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /internal/config.yml HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20100101 Fir
Requête brute (extrait)
GET /internal/config.yml HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20100101 Firefox/5.0 Iceweasel/5.0 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "yml",
"http_ua_hash": "9d8b2fa1599c74e63591442cc4d813329231ea73",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "84b99aee73556df7a4efeffa522f9587a983cdbf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 219,
"payload_entropy": 5.323462967417806,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 63,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "4e817595a1c0c8b3629b40eea2284a4077443447",
"event_fingerprint": "8ce06a6969b47b0c67840faae2458d0136f15b6f",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e18edfb1656e9676e904e728003d5bd4",
"payload_hash": "426618b0fbbd954672635dc75d8e1096",
"path_pattern_hash": "2e4a225629002cdfe7eaf4ad6aeee5e3"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "GET \/internal\/config.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:5.0) Gecko\/20100101 Fir",
"method": "GET",
"path": "\/internal\/config.yml",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:5.0) Gecko\/20100101 Firefox\/5.0 Iceweasel\/5.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/internal\/config.yml HTTP\/1.1",
"request_sample": "GET \/internal\/config.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:5.0) Gecko\/20100101 Firefox\/5.0 Iceweasel\/5.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/internal\/config.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:5.0) Gecko\/20100101 Fir",
"evidence": {
"method": "GET",
"path": "\/internal\/config.yml",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:5.0) Gecko\/20100101 Firefox\/5.0 Iceweasel\/5.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/internal\/config.yml HTTP\/1.1",
"request_sample": "GET \/internal\/config.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:5.0) Gecko\/20100101 Firefox\/5.0 Iceweasel\/5.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/internal\/config.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:5.0) Gecko\/20100101 Fir",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "30a66c66208d697a016d5634b236835772b1f1ad",
"protocol_details": {
"http_method": "GET",
"http_path": "\/internal\/config.yml",
"request_line": "GET \/internal\/config.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:5.0) Gecko\/20100101 Firefox\/5.0 Iceweasel\/5.0",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/internal\/config.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:5.0) Gecko\/20100101 Fir",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/internal\/config.yml",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/internal\/config.yml",
"request_line": "GET \/internal\/config.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:5.0) Gecko\/20100101 Firefox\/5.0 Iceweasel\/5.0",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/internal\/config.yml",
"evidence_snippet": "GET \/internal\/config.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:5.0) Gecko\/20100101 Fir",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_internal",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:57 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /WEB-INF/classes/application.properties
Élevée
Moyen · 62
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /WEB-INF/classes/application.properties UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/WEB-INF/classes/application.properties
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/WEB-INF/classes/application.properties
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 62
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /WEB-INF/classes/application.properties HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3835.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /WEB-INF/classes/application.properties HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x6
Requête brute (extrait)
GET /WEB-INF/classes/application.properties HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3835.0 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connec
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "properties",
"http_ua_hash": "01ee15dae79071fdf39af2559a09babd455f7b09",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "10b2e06ee448a350a7e1543add2e5ae160c495e4",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 271,
"payload_entropy": 5.424771897564535,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 62,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4e9ee6c02a5943d02ed1fdefbaf390ad3389e177",
"event_fingerprint": "f88e3aedc9bb74157c1b84acc8a50dfc162015aa",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1223ed10aebd352643ba72aee6c602cc",
"payload_hash": "3f83e26e18336c39ba120829bbcb293b",
"path_pattern_hash": "f8e656368886c0ce42a00ebbaba2414b"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 62
},
"payload_preview": "GET \/WEB-INF\/classes\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6",
"method": "GET",
"path": "\/WEB-INF\/classes\/application.properties",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/77.0.3835.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/WEB-INF\/classes\/application.properties HTTP\/1.1",
"request_sample": "GET \/WEB-INF\/classes\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/77.0.3835.0 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnec",
"payload_snippet": "GET \/WEB-INF\/classes\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6",
"evidence": {
"method": "GET",
"path": "\/WEB-INF\/classes\/application.properties",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/77.0.3835.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/WEB-INF\/classes\/application.properties HTTP\/1.1",
"request_sample": "GET \/WEB-INF\/classes\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/77.0.3835.0 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnec",
"payload_snippet": "GET \/WEB-INF\/classes\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b2158a3fa3065fd0618674da64e07c07f295c61",
"protocol_details": {
"http_method": "GET",
"http_path": "\/WEB-INF\/classes\/application.properties",
"request_line": "GET \/WEB-INF\/classes\/application.properties HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/77.0.3835.0 Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/WEB-INF\/classes\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/WEB-INF\/classes\/application.properties",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 62,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/WEB-INF\/classes\/application.properties",
"request_line": "GET \/WEB-INF\/classes\/application.properties HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/77.0.3835.0 Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/WEB-INF\/classes\/application.properties",
"evidence_snippet": "GET \/WEB-INF\/classes\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:57 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /config/application.yml
Élevée
Moyen · 63
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /config/application.yml UA Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_probe_config
Cible HTTP
GET
/config/application.yml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/config/application.yml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 63
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /config/application.yml HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /config/application.yml HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/53
Requête brute (extrait)
GET /config/application.yml HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "yml",
"http_ua_hash": "7c93348a2fb2fc2f2ffe623f65cb75dbca140f87",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "21bd12a36544d7656ab5efe66271236b69b5a1f6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 256,
"payload_entropy": 5.411126193616655,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 63,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cdaee4c0193336d2908d912640b1007030777e89",
"event_fingerprint": "9b1ec23245c7b09d74e21ac22c16fab97ef71cca",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "84d604d4c91d64d0fd4df1efc2ce7b4b",
"payload_hash": "39f002ffab53942d24c7408856f8879d",
"path_pattern_hash": "483067fc8f328a203e484adab257e7db"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "GET \/config\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/53",
"method": "GET",
"path": "\/config\/application.yml",
"user_agent": "Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/application.yml HTTP\/1.1",
"request_sample": "GET \/config\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/config\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/53",
"evidence": {
"method": "GET",
"path": "\/config\/application.yml",
"user_agent": "Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/application.yml HTTP\/1.1",
"request_sample": "GET \/config\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/config\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/53",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b3a87fb95a437a710b4a67fd1d4ac5e48587da89",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/application.yml",
"request_line": "GET \/config\/application.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/53",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/application.yml",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/application.yml",
"request_line": "GET \/config\/application.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/application.yml",
"evidence_snippet": "GET \/config\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/53",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_config",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:57 UTC
TCP
9900 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9900 · (tentative d'exploit) · → /internal/config.json
Élevée
Moyen · 62
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /internal/config.json UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_probe_internal
Cible HTTP
GET
/internal/config.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/internal/config.json
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 62
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /internal/config.json HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) snap Chromium/76.0.3809.87 Chrome/76.0.3809.87 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /internal/config.json HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML
Requête brute (extrait)
GET /internal/config.json HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) snap Chromium/76.0.3809.87 Chrome/76.0.3809.87 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connec
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "d61171168b95dbb6f5fda454ff9a5fe3927ed0b5",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "37c197fe9359087d8eaa32bd64802e5cf10f3318",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 271,
"payload_entropy": 5.425361414649584,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 84,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 84,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 62,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "49a6e1c5fe68ddb1907dcf862dc02ebb08c670ee",
"event_fingerprint": "5ab2d5786d39e6586e97b20fc3d4b35604ed2223",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 62,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9ddb9802525f1d2316c3a2056b73a9a7",
"payload_hash": "d8707d7d3313fdaad422ed1e4ec2625a",
"path_pattern_hash": "d046288edb8a0675371a7426276833c2"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 62
},
"payload_preview": "GET \/internal\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML",
"method": "GET",
"path": "\/internal\/config.json",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) snap Chromium\/76.0.3809.87 Chrome\/76.0.3809.87 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/internal\/config.json HTTP\/1.1",
"request_sample": "GET \/internal\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) snap Chromium\/76.0.3809.87 Chrome\/76.0.3809.87 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnec",
"payload_snippet": "GET \/internal\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML",
"evidence": {
"method": "GET",
"path": "\/internal\/config.json",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) snap Chromium\/76.0.3809.87 Chrome\/76.0.3809.87 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/internal\/config.json HTTP\/1.1",
"request_sample": "GET \/internal\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) snap Chromium\/76.0.3809.87 Chrome\/76.0.3809.87 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnec",
"payload_snippet": "GET \/internal\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "aa5523a86108837c328e7e0032537ff0b86fcaee",
"protocol_details": {
"http_method": "GET",
"http_path": "\/internal\/config.json",
"request_line": "GET \/internal\/config.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) snap Chromium\/76.0.3809.87 Chrome\/76.0.3809.87 S\u2026",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/internal\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML",
"attack_vector": "config file probe \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/internal\/config.json",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 62,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 62,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/internal\/config.json",
"request_line": "GET \/internal\/config.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) snap Chromium\/76.0.3809.87 Chrome\/76.0.3809.87 S\u2026",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/internal\/config.json",
"evidence_snippet": "GET \/internal\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_internal",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:57 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /public/js/sendgrid.js
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /public/js/sendgrid.js UA Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.6) Gecko/2004040…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/public/js/sendgrid.js
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/public/js/sendgrid.js
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /public/js/sendgrid.js HTTP/1.1
User-Agent
Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.6) Gecko/20040406 Galeon/1.3.15
Règles WAF
lfi-14
rce-0
nosqli-3
Payload (extrait)
GET /public/js/sendgrid.js HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.6) Gecko/
Requête brute (extrait)
GET /public/js/sendgrid.js HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.6) Gecko/20040406 Galeon/1.3.15 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "js",
"http_ua_hash": "cd7f935f67e2c2d3b340fe2f661c4eb4c7ca3bfc",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "3d8d45d4780341cf69b3566ae14a0edf2136ab23",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 219,
"payload_entropy": 5.34907153285678,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 68,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "d18375cb9bfc977ce44d65a074a1ee3e8f5c9fcc",
"event_fingerprint": "f87e7ea234c4e294eb42835109d2b25678883282",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "4ba5f0424b032695635664639be2c84c",
"payload_hash": "f58535d03f2466bce1ae6c72b1133afc",
"path_pattern_hash": "f58945cff6efd1a814c6e2366d5811fb"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/public\/js\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; U; FreeBSD i386; en-US; rv:1.6) Gecko\/",
"method": "GET",
"path": "\/public\/js\/sendgrid.js",
"user_agent": "Mozilla\/5.0 (X11; U; FreeBSD i386; en-US; rv:1.6) Gecko\/20040406 Galeon\/1.3.15",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/public\/js\/sendgrid.js HTTP\/1.1",
"request_sample": "GET \/public\/js\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; U; FreeBSD i386; en-US; rv:1.6) Gecko\/20040406 Galeon\/1.3.15\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/public\/js\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; U; FreeBSD i386; en-US; rv:1.6) Gecko\/",
"evidence": {
"method": "GET",
"path": "\/public\/js\/sendgrid.js",
"user_agent": "Mozilla\/5.0 (X11; U; FreeBSD i386; en-US; rv:1.6) Gecko\/20040406 Galeon\/1.3.15",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/public\/js\/sendgrid.js HTTP\/1.1",
"request_sample": "GET \/public\/js\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; U; FreeBSD i386; en-US; rv:1.6) Gecko\/20040406 Galeon\/1.3.15\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/public\/js\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; U; FreeBSD i386; en-US; rv:1.6) Gecko\/",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "13682be2beaf133dbb6c7e2c2ca4e80ccc3e2cb0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/public\/js\/sendgrid.js",
"request_line": "GET \/public\/js\/sendgrid.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; U; FreeBSD i386; en-US; rv:1.6) Gecko\/20040406 Galeon\/1.3.15",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/public\/js\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; U; FreeBSD i386; en-US; rv:1.6) Gecko\/",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/public\/js\/sendgrid.js",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/public\/js\/sendgrid.js",
"request_line": "GET \/public\/js\/sendgrid.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; U; FreeBSD i386; en-US; rv:1.6) Gecko\/20040406 Galeon\/1.3.15",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/public\/js\/sendgrid.js",
"evidence_snippet": "GET \/public\/js\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; U; FreeBSD i386; en-US; rv:1.6) Gecko\/",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:57 UTC
TCP
9900 · HTTP
Sonde fichier credential / clé
credential file probe · via HTTP:9900 · (tentative d'exploit) · → /services/secrets.json
Élevée
Moyen · 63
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /services/secrets.json UA Mozilla/5.0 (Linux; Android 7.0; KIICAA POWER) AppleWebKit/537.…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_k8s_probe
Cible HTTP
GET
/services/secrets.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/services/secrets.json
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « rce-0 » · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 63
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0496
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Secrets JSON file
Ligne de requête
GET /services/secrets.json HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 7.0; KIICAA POWER) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.101 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /services/secrets.json HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (Linux; Android 7.0; KIICAA POWER) AppleWebK
Requête brute (extrait)
GET /services/secrets.json HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (Linux; Android 7.0; KIICAA POWER) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.101 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connectio
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "29ba1869a5dedd50f2a9b3827cbe59b68a36160c",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "e5f28d9dabe348c75152a0d03b8af3948967c412",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 268,
"payload_entropy": 5.426454737427215,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 84,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 63,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "4bf12cc5e57f4da7447fb93105837548b2ea8ade",
"event_fingerprint": "7c6f0634c1ede8cc9d5e76fbc752ba57a08e1740",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 135,
"precision_signals": [
"pat-0496",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"pat-0496",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0496"
],
"matched_pattern_names": [
"Cred Secrets JSON file"
],
"pattern_ids": [
"pat-0496"
],
"confidence_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "d1cb157ce614ce2a26520a7a237d54a0",
"payload_hash": "ffa15c2b12e192ed880af651a662bd3e",
"path_pattern_hash": "e5ca14018f208a625d89b1bb0ac742c9"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "GET \/services\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; KIICAA POWER) AppleWebK",
"method": "GET",
"path": "\/services\/secrets.json",
"user_agent": "Mozilla\/5.0 (Linux; Android 7.0; KIICAA POWER) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.101 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/services\/secrets.json HTTP\/1.1",
"request_sample": "GET \/services\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; KIICAA POWER) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.101 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnectio",
"payload_snippet": "GET \/services\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; KIICAA POWER) AppleWebK",
"evidence": {
"method": "GET",
"path": "\/services\/secrets.json",
"user_agent": "Mozilla\/5.0 (Linux; Android 7.0; KIICAA POWER) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.101 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/services\/secrets.json HTTP\/1.1",
"request_sample": "GET \/services\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; KIICAA POWER) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.101 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnectio",
"payload_snippet": "GET \/services\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; KIICAA POWER) AppleWebK",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "67b6e21a8a7452951c2feb68be47f4f876e4f4a1",
"protocol_details": {
"http_method": "GET",
"http_path": "\/services\/secrets.json",
"request_line": "GET \/services\/secrets.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 7.0; KIICAA POWER) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.101 Mobile Safar\u2026",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/services\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; KIICAA POWER) AppleWebK",
"attack_vector": "credential file probe \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/services\/secrets.json",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"pat-0496",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"pat-0496",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/services\/secrets.json",
"request_line": "GET \/services\/secrets.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 7.0; KIICAA POWER) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.101 Mobile Safar\u2026",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/services\/secrets.json",
"evidence_snippet": "GET \/services\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; KIICAA POWER) AppleWebK",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_k8s_probe",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:57 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /server.key
Élevée
Moyen · 54
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /server.key UA Mozilla/5.0 (Android 6.0.1; Mobile; rv:48.0) Gecko/48.0 Firefox…
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
net_flood
Cible HTTP
GET
/server.key
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/server.key
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Server private key
Ligne de requête
GET /server.key HTTP/1.1
User-Agent
Mozilla/5.0 (Android 6.0.1; Mobile; rv:48.0) Gecko/48.0 Firefox/48.0
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /server.key HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (Android 6.0.1; Mobile; rv:48.0) Gecko/48.0 Firefox/48.
Requête brute (extrait)
GET /server.key HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (Android 6.0.1; Mobile; rv:48.0) Gecko/48.0 Firefox/48.0 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "key",
"http_ua_hash": "b5d3160edbd9ec3290854f4652f5eeceabb1af03",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "cf1afbf8420628be2ea8315c59921f18b70510e8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.257900326794799,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 60,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 54,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "46b38a66c1d5f50cf15dd70a9739194f116117c8",
"event_fingerprint": "825782c20fe1bb859fac68c180fcdd5e26461c9b",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0499"
],
"matched_pattern_names": [
"Cred Server private key"
],
"pattern_ids": [
"pat-0499"
],
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "0a43cd980fc948b1efc5a6d8ad95958f",
"payload_hash": "4b25113746cb2a1dc0718b74af042dbf",
"path_pattern_hash": "51ffc9c2865ea094d2e6b0576cde621f"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/server.key HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Android 6.0.1; Mobile; rv:48.0) Gecko\/48.0 Firefox\/48.",
"method": "GET",
"path": "\/server.key",
"user_agent": "Mozilla\/5.0 (Android 6.0.1; Mobile; rv:48.0) Gecko\/48.0 Firefox\/48.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/server.key HTTP\/1.1",
"request_sample": "GET \/server.key HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Android 6.0.1; Mobile; rv:48.0) Gecko\/48.0 Firefox\/48.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/server.key HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Android 6.0.1; Mobile; rv:48.0) Gecko\/48.0 Firefox\/48.",
"evidence": {
"method": "GET",
"path": "\/server.key",
"user_agent": "Mozilla\/5.0 (Android 6.0.1; Mobile; rv:48.0) Gecko\/48.0 Firefox\/48.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/server.key HTTP\/1.1",
"request_sample": "GET \/server.key HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Android 6.0.1; Mobile; rv:48.0) Gecko\/48.0 Firefox\/48.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/server.key HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Android 6.0.1; Mobile; rv:48.0) Gecko\/48.0 Firefox\/48.",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b17d30799f835030add87aea55274b236e8b198d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server.key",
"request_line": "GET \/server.key HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Android 6.0.1; Mobile; rv:48.0) Gecko\/48.0 Firefox\/48.0",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/server.key HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Android 6.0.1; Mobile; rv:48.0) Gecko\/48.0 Firefox\/48.",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server.key",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server.key",
"request_line": "GET \/server.key HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Android 6.0.1; Mobile; rv:48.0) Gecko\/48.0 Firefox\/48.0",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server.key",
"evidence_snippet": "GET \/server.key HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Android 6.0.1; Mobile; rv:48.0) Gecko\/48.0 Firefox\/48.",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:57 UTC
TCP
9900 · HTTP
Sonde fichier credential / clé
credential file probe · via HTTP:9900 · (tentative d'exploit) · → /private/secrets.json
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /private/secrets.json UA POLARIS/6.01(BREW 3.1.5;U;en-us;LG;LX265;POLARIS/6.01/WAP;)MMP/…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/private/secrets.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/private/secrets.json
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « lfi-14 » · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
pat-0496
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Secrets JSON file
Ligne de requête
GET /private/secrets.json HTTP/1.1
User-Agent
POLARIS/6.01(BREW 3.1.5;U;en-us;LG;LX265;POLARIS/6.01/WAP;)MMP/2.0 profile/MIDP-201 Configuration /CLDC-1.1
Règles WAF
lfi-14
rce-0
nosqli-3
Payload (extrait)
GET /private/secrets.json HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: POLARIS/6.01(BREW 3.1.5;U;en-us;LG;LX265;POLARIS/6.01/WAP
Requête brute (extrait)
GET /private/secrets.json HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: POLARIS/6.01(BREW 3.1.5;U;en-us;LG;LX265;POLARIS/6.01/WAP;)MMP/2.0 profile/MIDP-201 Configuration /CLDC-1.1 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "4a0435d4480da23db5d7a4effa1e42aa3271e477",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "1a592bf2c5d0fa0649bfef76bf43dc28f3f43a27",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 247,
"payload_entropy": 5.446126487540893,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 100,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "205c7cabfdceaa6ad55ca0c0b02eb39b0a4ea3c2",
"event_fingerprint": "be47b5db9f1e8c71d2e0f60c629c0b4ab37c9bd6",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 135,
"precision_signals": [
"pat-0496",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"pat-0496",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0496"
],
"matched_pattern_names": [
"Cred Secrets JSON file"
],
"pattern_ids": [
"pat-0496"
],
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f9b3da601a7c969c40d85033bad0228",
"payload_hash": "fbecd66215bd92302996a0dcc71d0339",
"path_pattern_hash": "28bdca9eb7d8c2f1408ad5c40bac8497"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/private\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: POLARIS\/6.01(BREW 3.1.5;U;en-us;LG;LX265;POLARIS\/6.01\/WAP",
"method": "GET",
"path": "\/private\/secrets.json",
"user_agent": "POLARIS\/6.01(BREW 3.1.5;U;en-us;LG;LX265;POLARIS\/6.01\/WAP;)MMP\/2.0 profile\/MIDP-201 Configuration \/CLDC-1.1",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/private\/secrets.json HTTP\/1.1",
"request_sample": "GET \/private\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: POLARIS\/6.01(BREW 3.1.5;U;en-us;LG;LX265;POLARIS\/6.01\/WAP;)MMP\/2.0 profile\/MIDP-201 Configuration \/CLDC-1.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/private\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: POLARIS\/6.01(BREW 3.1.5;U;en-us;LG;LX265;POLARIS\/6.01\/WAP",
"evidence": {
"method": "GET",
"path": "\/private\/secrets.json",
"user_agent": "POLARIS\/6.01(BREW 3.1.5;U;en-us;LG;LX265;POLARIS\/6.01\/WAP;)MMP\/2.0 profile\/MIDP-201 Configuration \/CLDC-1.1",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/private\/secrets.json HTTP\/1.1",
"request_sample": "GET \/private\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: POLARIS\/6.01(BREW 3.1.5;U;en-us;LG;LX265;POLARIS\/6.01\/WAP;)MMP\/2.0 profile\/MIDP-201 Configuration \/CLDC-1.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/private\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: POLARIS\/6.01(BREW 3.1.5;U;en-us;LG;LX265;POLARIS\/6.01\/WAP",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "11061e11269b45d7d8feb759bd6d9fcefeb5898b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/private\/secrets.json",
"request_line": "GET \/private\/secrets.json HTTP\/1.1",
"http_user_agent": "POLARIS\/6.01(BREW 3.1.5;U;en-us;LG;LX265;POLARIS\/6.01\/WAP;)MMP\/2.0 profile\/MIDP-201 Configuration \/CLDC-1.1",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/private\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: POLARIS\/6.01(BREW 3.1.5;U;en-us;LG;LX265;POLARIS\/6.01\/WAP",
"attack_vector": "credential file probe \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/private\/secrets.json",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"pat-0496",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"pat-0496",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/private\/secrets.json",
"request_line": "GET \/private\/secrets.json HTTP\/1.1",
"http_user_agent": "POLARIS\/6.01(BREW 3.1.5;U;en-us;LG;LX265;POLARIS\/6.01\/WAP;)MMP\/2.0 profile\/MIDP-201 Configuration \/CLDC-1.1",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/private\/secrets.json",
"evidence_snippet": "GET \/private\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: POLARIS\/6.01(BREW 3.1.5;U;en-us;LG;LX265;POLARIS\/6.01\/WAP",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_k8s_probe",
"http_probe_private",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:57 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /config/services.php
Élevée
Moyen · 63
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /config/services.php UA Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_probe_config
Cible HTTP
GET
/config/services.php
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/config/services.php
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 63
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /config/services.php HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /config/services.php HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.3
Requête brute (extrait)
GET /config/services.php HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "php",
"http_ua_hash": "101f08546915744f849da0d5b99ff8b8f9b8dcb5",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "3ca2bec84ec8ba69efd80baa52ae496391a16c98",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 253,
"payload_entropy": 5.41757345277942,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 63,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "c070fbfdc922d3ca5341e5ea21b34fc6f9d452f3",
"event_fingerprint": "e2cb7bf7ef88e22f9a3c85b1bb7e1b2bbebcfa07",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "189c5262cf21079a4cb04660fe26305d",
"payload_hash": "e7bb408bed311428cf1a31dc64523f6b",
"path_pattern_hash": "1a4e64bcf01550beeb5ff11653df0118"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "GET \/config\/services.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.3",
"method": "GET",
"path": "\/config\/services.php",
"user_agent": "Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/services.php HTTP\/1.1",
"request_sample": "GET \/config\/services.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/config\/services.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.3",
"evidence": {
"method": "GET",
"path": "\/config\/services.php",
"user_agent": "Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/services.php HTTP\/1.1",
"request_sample": "GET \/config\/services.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/config\/services.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.3",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2587a7773d0bc87cb462942230cf1e638e4c2259",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/services.php",
"request_line": "GET \/config\/services.php HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/services.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.3",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/services.php",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/services.php",
"request_line": "GET \/config\/services.php HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/services.php",
"evidence_snippet": "GET \/config\/services.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.3",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_config",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:57 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /sendgrid.min.js
Élevée
Moyen · 54
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /sendgrid.min.js UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537…
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
net_flood
Cible HTTP
GET
/sendgrid.min.js
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/sendgrid.min.js
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /sendgrid.min.js HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.80 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /sendgrid.min.js HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/53
Requête brute (extrait)
GET /sendgrid.min.js HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.80 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "js",
"http_ua_hash": "98f38537a8dfc3b008138091f5ff357e27b3d266",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "c3c746112c0f0239b9db723ddc097884068a0409",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 255,
"payload_entropy": 5.426152433845988,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 60,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 54,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "46b38a66c1d5f50cf15dd70a9739194f116117c8",
"event_fingerprint": "1f113d75a2005a8a0c8abc9af6d2c70a6cbedd15",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c4790fcb2dd6f6fa002f21f00668390b",
"payload_hash": "6110c345ec12a9b7a4ba155e7ca9eb9e",
"path_pattern_hash": "eedccc9bc850fd543465f59f02102b9c"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/sendgrid.min.js HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/53",
"method": "GET",
"path": "\/sendgrid.min.js",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.80 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/sendgrid.min.js HTTP\/1.1",
"request_sample": "GET \/sendgrid.min.js HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.80 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sendgrid.min.js HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/53",
"evidence": {
"method": "GET",
"path": "\/sendgrid.min.js",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.80 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/sendgrid.min.js HTTP\/1.1",
"request_sample": "GET \/sendgrid.min.js HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.80 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sendgrid.min.js HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/53",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1c745977c45bfa1f06ed66cd11c18946aca3cd40",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid.min.js",
"request_line": "GET \/sendgrid.min.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.80 Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sendgrid.min.js HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/53",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid.min.js",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid.min.js",
"request_line": "GET \/sendgrid.min.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.80 Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid.min.js",
"evidence_snippet": "GET \/sendgrid.min.js HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/53",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:57 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /config/cache.php
Élevée
Moyen · 63
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /config/cache.php UA Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML,…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_probe_config
Cible HTTP
GET
/config/cache.php
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/config/cache.php
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 63
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /config/cache.php HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.62 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /config/cache.php HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTM
Requête brute (extrait)
GET /config/cache.php HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.62 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "php",
"http_ua_hash": "1f920ae0095efc9859bfd9a1389770e0b824fad1",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "9692de7bdad9583db6331e50d4b9dacf18ddb2e0",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 245,
"payload_entropy": 5.40150435279966,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 63,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "c070fbfdc922d3ca5341e5ea21b34fc6f9d452f3",
"event_fingerprint": "097e5cfe50468e97d897bd0c4d7c7d6c14b376e4",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "d3c801a3fcd8b02495806d8ab846c2e4",
"payload_hash": "527d99122d055be1b610d2c4d78ff7ac",
"path_pattern_hash": "875d6aa330eaf796664c4387fbf0c3b1"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "GET \/config\/cache.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTM",
"method": "GET",
"path": "\/config\/cache.php",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/62.0.3202.62 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/cache.php HTTP\/1.1",
"request_sample": "GET \/config\/cache.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/62.0.3202.62 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/config\/cache.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTM",
"evidence": {
"method": "GET",
"path": "\/config\/cache.php",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/62.0.3202.62 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/cache.php HTTP\/1.1",
"request_sample": "GET \/config\/cache.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/62.0.3202.62 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/config\/cache.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTM",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e1d366850f97fbc992b095ed2e90e601f1eec8c3",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/cache.php",
"request_line": "GET \/config\/cache.php HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/62.0.3202.62 Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/cache.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTM",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/cache.php",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/cache.php",
"request_line": "GET \/config\/cache.php HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/62.0.3202.62 Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/cache.php",
"evidence_snippet": "GET \/config\/cache.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTM",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_config",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:57 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /backend/sendgrid.js
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /backend/sendgrid.js UA Mozilla/5.0 (SymbianOS 9.4; Series60/5.0 NokiaN97-1/10.0.012; P…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/backend/sendgrid.js
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/backend/sendgrid.js
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /backend/sendgrid.js HTTP/1.1
User-Agent
Mozilla/5.0 (SymbianOS 9.4; Series60/5.0 NokiaN97-1/10.0.012; Profile/MIDP-2.1 Configuration/CLDC-1.1; en-us) AppleWebKit/525 (KHTML, like Gecko) WicKed/7.1.12344
Règles WAF
lfi-14
rce-0
nosqli-3
Payload (extrait)
GET /backend/sendgrid.js HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (SymbianOS 9.4; Series60/5.0 NokiaN97-1/10.0.0
Requête brute (extrait)
GET /backend/sendgrid.js HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (SymbianOS 9.4; Series60/5.0 NokiaN97-1/10.0.012; Profile/MIDP-2.1 Configuration/CLDC-1.1; en-us) AppleWebKit/525 (KHTML, like Gecko) WicKed/7.1.12344 Accept-Charset: utf-8
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "js",
"http_ua_hash": "69bceb9b63dde37e097a8889a2bef2426a79a0a0",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "7780371ee1da1efa0a933ac9cc0a62e8162ae0b1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 301,
"payload_entropy": 5.480417723006811,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 68,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "0344a17a739ce6416f1534ac8ebbae2a6a5ab63e",
"event_fingerprint": "1d515430ff0356ef9018aa881ad6a9f3ce6b8404",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9e0d8cbecd41a217bddca6fb6f3ce41a",
"payload_hash": "831cd16b6a00b54645065bafdf86115e",
"path_pattern_hash": "6b7d9f0363df4f0d6ef22b0d50871ee8"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/backend\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (SymbianOS 9.4; Series60\/5.0 NokiaN97-1\/10.0.0",
"method": "GET",
"path": "\/backend\/sendgrid.js",
"user_agent": "Mozilla\/5.0 (SymbianOS 9.4; Series60\/5.0 NokiaN97-1\/10.0.012; Profile\/MIDP-2.1 Configuration\/CLDC-1.1; en-us) AppleWebKit\/525 (KHTML, like Gecko) WicKed\/7.1.12344",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backend\/sendgrid.js HTTP\/1.1",
"request_sample": "GET \/backend\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (SymbianOS 9.4; Series60\/5.0 NokiaN97-1\/10.0.012; Profile\/MIDP-2.1 Configuration\/CLDC-1.1; en-us) AppleWebKit\/525 (KHTML, like Gecko) WicKed\/7.1.12344\r\nAccept-Charset: utf-8\r",
"payload_snippet": "GET \/backend\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (SymbianOS 9.4; Series60\/5.0 NokiaN97-1\/10.0.0",
"evidence": {
"method": "GET",
"path": "\/backend\/sendgrid.js",
"user_agent": "Mozilla\/5.0 (SymbianOS 9.4; Series60\/5.0 NokiaN97-1\/10.0.012; Profile\/MIDP-2.1 Configuration\/CLDC-1.1; en-us) AppleWebKit\/525 (KHTML, like Gecko) WicKed\/7.1.12344",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backend\/sendgrid.js HTTP\/1.1",
"request_sample": "GET \/backend\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (SymbianOS 9.4; Series60\/5.0 NokiaN97-1\/10.0.012; Profile\/MIDP-2.1 Configuration\/CLDC-1.1; en-us) AppleWebKit\/525 (KHTML, like Gecko) WicKed\/7.1.12344\r\nAccept-Charset: utf-8\r",
"payload_snippet": "GET \/backend\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (SymbianOS 9.4; Series60\/5.0 NokiaN97-1\/10.0.0",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3a6287434a33ea41380a60eebe5fa64c74e78ab4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/sendgrid.js",
"request_line": "GET \/backend\/sendgrid.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (SymbianOS 9.4; Series60\/5.0 NokiaN97-1\/10.0.012; Profile\/MIDP-2.1 Configuration\/CLDC-1.1; en-us) AppleWebK\u2026",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (SymbianOS 9.4; Series60\/5.0 NokiaN97-1\/10.0.0",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/sendgrid.js",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/sendgrid.js",
"request_line": "GET \/backend\/sendgrid.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (SymbianOS 9.4; Series60\/5.0 NokiaN97-1\/10.0.012; Profile\/MIDP-2.1 Configuration\/CLDC-1.1; en-us) AppleWebK\u2026",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/sendgrid.js",
"evidence_snippet": "GET \/backend\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (SymbianOS 9.4; Series60\/5.0 NokiaN97-1\/10.0.0",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:57 UTC
TCP
9900 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9900 · (tentative d'exploit) · → /wp-config.php.bak
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /wp-config.php.bak UA Mozilla/5.0 (MeeGo; NokiaN950-00/00) AppleWebKit/534.13 (KHTML,…
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950470:nosqli-3
950518:leak-5
Cible HTTP
GET
/wp-config.php.bak
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/wp-config.php.bak
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « lfi-14 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0195
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 933111
LFI WordPress config backup
Probe /wp-config.php
Ligne de requête
GET /wp-config.php.bak HTTP/1.1
User-Agent
Mozilla/5.0 (MeeGo; NokiaN950-00/00) AppleWebKit/534.13 (KHTML, like Gecko) NokiaBrowser/8.5.0 Mobile Safari/534.13
Règles WAF
lfi-14
rce-0
nosqli-3
leak-5
leak-8
Payload (extrait)
GET /wp-config.php.bak HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (MeeGo; NokiaN950-00/00) AppleWebKit/534.13 (KHT
Requête brute (extrait)
GET /wp-config.php.bak HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (MeeGo; NokiaN950-00/00) AppleWebKit/534.13 (KHTML, like Gecko) NokiaBrowser/8.5.0 Mobile Safari/534.13 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "bak",
"http_ua_hash": "24b8ae7e550e8f1fa3b279857f9041f923b8c173",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "0372d7102c333673ea0de9e60c73911cb60bfb5f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 252,
"payload_entropy": 5.35874250277827,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 9,
"anomaly_count": 0,
"campaign_key": "30b0ceeeea16fee26f9928fc2694f2a28097a2dc",
"event_fingerprint": "4c11892d20600f4844d1d80ee387ee8a86f8d284",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0195",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0195",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0160",
"pat-0135",
"pat-0195"
],
"matched_pattern_names": [
"CRS 933111",
"LFI WordPress config backup",
"Probe \/wp-config.php"
],
"pattern_ids": [
"pat-0160",
"pat-0135",
"pat-0195"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8023f80db0137313b234a5b9a095d867",
"payload_hash": "a2be4187341349c01ee0f4ea16b8c039",
"path_pattern_hash": "c879a1d8584c2c545f6c6bb7a9f5a061"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/wp-config.php.bak HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (MeeGo; NokiaN950-00\/00) AppleWebKit\/534.13 (KHT",
"method": "GET",
"path": "\/wp-config.php.bak",
"user_agent": "Mozilla\/5.0 (MeeGo; NokiaN950-00\/00) AppleWebKit\/534.13 (KHTML, like Gecko) NokiaBrowser\/8.5.0 Mobile Safari\/534.13",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950470:nosqli-3",
"950518:leak-5",
"950521:leak-8"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3",
"leak-5",
"leak-8"
],
"request_line": "GET \/wp-config.php.bak HTTP\/1.1",
"request_sample": "GET \/wp-config.php.bak HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (MeeGo; NokiaN950-00\/00) AppleWebKit\/534.13 (KHTML, like Gecko) NokiaBrowser\/8.5.0 Mobile Safari\/534.13\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/wp-config.php.bak HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (MeeGo; NokiaN950-00\/00) AppleWebKit\/534.13 (KHT",
"evidence": {
"method": "GET",
"path": "\/wp-config.php.bak",
"user_agent": "Mozilla\/5.0 (MeeGo; NokiaN950-00\/00) AppleWebKit\/534.13 (KHTML, like Gecko) NokiaBrowser\/8.5.0 Mobile Safari\/534.13",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950470:nosqli-3",
"950518:leak-5",
"950521:leak-8"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3",
"leak-5",
"leak-8"
],
"request_line": "GET \/wp-config.php.bak HTTP\/1.1",
"request_sample": "GET \/wp-config.php.bak HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (MeeGo; NokiaN950-00\/00) AppleWebKit\/534.13 (KHTML, like Gecko) NokiaBrowser\/8.5.0 Mobile Safari\/534.13\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/wp-config.php.bak HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (MeeGo; NokiaN950-00\/00) AppleWebKit\/534.13 (KHT",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "274352894f4ec06e30ab544240a9f913d527cc23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-config.php.bak",
"request_line": "GET \/wp-config.php.bak HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (MeeGo; NokiaN950-00\/00) AppleWebKit\/534.13 (KHTML, like Gecko) NokiaBrowser\/8.5.0 Mobile Safari\/534.13",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/wp-config.php.bak HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (MeeGo; NokiaN950-00\/00) AppleWebKit\/534.13 (KHT",
"attack_vector": "config file probe \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-config.php.bak",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0195",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0195",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-config.php.bak",
"request_line": "GET \/wp-config.php.bak HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (MeeGo; NokiaN950-00\/00) AppleWebKit\/534.13 (KHTML, like Gecko) NokiaBrowser\/8.5.0 Mobile Safari\/534.13",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-config.php.bak",
"evidence_snippet": "GET \/wp-config.php.bak HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (MeeGo; NokiaN950-00\/00) AppleWebKit\/534.13 (KHT",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950470:nosqli-3",
"950518:leak-5",
"950521:leak-8",
"http_backup_file_scan",
"http_backup_path",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:57 UTC
TCP
9900 · HTTP
Sonde fichier credential / clé
credential file probe · via HTTP:9900 · (tentative d'exploit) · → /private/credentials.json
Élevée
Moyen · 63
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /private/credentials.json UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US) AppleWebKit/125…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_probe_private
Cible HTTP
GET
/private/credentials.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/private/credentials.json
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « rce-0 » · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 63
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0472
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Credentials JSON
Ligne de requête
GET /private/credentials.json HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US) AppleWebKit/125.4 (KHTML, like Gecko, Safari) OmniWeb/v563.15
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /private/credentials.json HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US) Apple
Requête brute (extrait)
GET /private/credentials.json HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US) AppleWebKit/125.4 (KHTML, like Gecko, Safari) OmniWeb/v563.15 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "12c925cde932675ad2d938b73ea9509ae86f897b",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "f5b98432b4ea101afd265888d823143de70b6fa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 253,
"payload_entropy": 5.404773948410745,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 84,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 63,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "0e44c5d3bede8bfdfe9696c657e1aab802f37f95",
"event_fingerprint": "b6a8d255fc5a3288f2633ed251c588b7ddf987a3",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 135,
"precision_signals": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0472"
],
"matched_pattern_names": [
"Cred Credentials JSON"
],
"pattern_ids": [
"pat-0472"
],
"confidence_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1cabf74e242074910d5c90bc3f85c1e5",
"payload_hash": "3157bb50abf506c385e4351d28c1b6c8",
"path_pattern_hash": "b18c0d27f50ba8fd3156a9c7a907fc4a"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "GET \/private\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-US) Apple",
"method": "GET",
"path": "\/private\/credentials.json",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-US) AppleWebKit\/125.4 (KHTML, like Gecko, Safari) OmniWeb\/v563.15",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/private\/credentials.json HTTP\/1.1",
"request_sample": "GET \/private\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-US) AppleWebKit\/125.4 (KHTML, like Gecko, Safari) OmniWeb\/v563.15\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/private\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-US) Apple",
"evidence": {
"method": "GET",
"path": "\/private\/credentials.json",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-US) AppleWebKit\/125.4 (KHTML, like Gecko, Safari) OmniWeb\/v563.15",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/private\/credentials.json HTTP\/1.1",
"request_sample": "GET \/private\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-US) AppleWebKit\/125.4 (KHTML, like Gecko, Safari) OmniWeb\/v563.15\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/private\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-US) Apple",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f351143b1b84c563f4d14db2f59a114a49a585fd",
"protocol_details": {
"http_method": "GET",
"http_path": "\/private\/credentials.json",
"request_line": "GET \/private\/credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-US) AppleWebKit\/125.4 (KHTML, like Gecko, Safari) OmniWeb\/v563.15",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/private\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-US) Apple",
"attack_vector": "credential file probe \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/private\/credentials.json",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"pat-0472",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/private\/credentials.json",
"request_line": "GET \/private\/credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-US) AppleWebKit\/125.4 (KHTML, like Gecko, Safari) OmniWeb\/v563.15",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/private\/credentials.json",
"evidence_snippet": "GET \/private\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-US) Apple",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_private",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:56 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /config/settings.php
Élevée
Moyen · 63
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /config/settings.php UA Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_7; en-us) AppleWeb…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_probe_config
Cible HTTP
GET
/config/settings.php
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/config/settings.php
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 63
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Settings PHP
Ligne de requête
GET /config/settings.php HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_7; en-us) AppleWebKit/534.20.8 (KHTML, like Gecko) Version/5.1 Safari/534.20.8
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /config/settings.php HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_7; en-us) App
Requête brute (extrait)
GET /config/settings.php HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_7; en-us) AppleWebKit/534.20.8 (KHTML, like Gecko) Version/5.1 Safari/534.20.8 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: clo
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "php",
"http_ua_hash": "079e3de50bcdbf8580bfa0fd98d0bb85cbec5239",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "418a5f6a5e1110ffbd155bc9313c50008e60f423",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 262,
"payload_entropy": 5.367218389314554,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 63,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "c070fbfdc922d3ca5341e5ea21b34fc6f9d452f3",
"event_fingerprint": "f615227cbc5e9acfff9d55f0987b1109a6f1c28a",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0500"
],
"matched_pattern_names": [
"Cred Settings PHP"
],
"pattern_ids": [
"pat-0500"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "19309e553217fe51389181ea4603dcfb",
"payload_hash": "148dccfd790b687eb6b610858f35fdc1",
"path_pattern_hash": "b9b36a42819ef11fa7d42979d581f393"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "GET \/config\/settings.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X 10_7; en-us) App",
"method": "GET",
"path": "\/config\/settings.php",
"user_agent": "Mozilla\/5.0 (Macintosh; U; Intel Mac OS X 10_7; en-us) AppleWebKit\/534.20.8 (KHTML, like Gecko) Version\/5.1 Safari\/534.20.8",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/settings.php HTTP\/1.1",
"request_sample": "GET \/config\/settings.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X 10_7; en-us) AppleWebKit\/534.20.8 (KHTML, like Gecko) Version\/5.1 Safari\/534.20.8\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: clo",
"payload_snippet": "GET \/config\/settings.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X 10_7; en-us) App",
"evidence": {
"method": "GET",
"path": "\/config\/settings.php",
"user_agent": "Mozilla\/5.0 (Macintosh; U; Intel Mac OS X 10_7; en-us) AppleWebKit\/534.20.8 (KHTML, like Gecko) Version\/5.1 Safari\/534.20.8",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/settings.php HTTP\/1.1",
"request_sample": "GET \/config\/settings.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X 10_7; en-us) AppleWebKit\/534.20.8 (KHTML, like Gecko) Version\/5.1 Safari\/534.20.8\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: clo",
"payload_snippet": "GET \/config\/settings.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X 10_7; en-us) App",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6575a7964a56fabbd69604bde3a2b52d3b801bb2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/settings.php",
"request_line": "GET \/config\/settings.php HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; Intel Mac OS X 10_7; en-us) AppleWebKit\/534.20.8 (KHTML, like Gecko) Version\/5.1 Safari\/534.\u2026",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/settings.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X 10_7; en-us) App",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/settings.php",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/settings.php",
"request_line": "GET \/config\/settings.php HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; Intel Mac OS X 10_7; en-us) AppleWebKit\/534.20.8 (KHTML, like Gecko) Version\/5.1 Safari\/534.\u2026",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/settings.php",
"evidence_snippet": "GET \/config\/settings.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X 10_7; en-us) App",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_config",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /src/settings.py
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /src/settings.py UA Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Ge…
Émulateur
HTTP
WAF
12
Recommandation
Investiguer
Tags
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/src/settings.py
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/src/settings.py
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 52
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Django settings
Ligne de requête
GET /src/settings.py HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36
Règles WAF
nosqli-3
Payload (extrait)
GET /src/settings.py HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like G
Requête brute (extrait)
GET /src/settings.py HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "py",
"http_ua_hash": "3e62ec46a183c69a55ed31269b235ccf9bdd2a0f",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "d5789d665736cfa0ddfe8b823927e941f800dee5",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 237,
"payload_entropy": 5.34792775135504,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 56,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 56,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 52,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "c8645a0b987fa6a1488206ae52d840117f8b33b7",
"event_fingerprint": "64e01f93736085b82d971e6161ea30ed81320cb1",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0112"
],
"matched_pattern_names": [
"LFI Django settings"
],
"pattern_ids": [
"pat-0112"
],
"confidence_breakdown": {
"waf": 56,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "cb53089272df4cb05d27ca93931c1d6e",
"payload_hash": "b9fc62a2ab4db9171c85d2428c7ff26f",
"path_pattern_hash": "618ceab0c9dfa4ac1499dac941778116"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 52
},
"payload_preview": "GET \/src\/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like G",
"method": "GET",
"path": "\/src\/settings.py",
"user_agent": "Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Safari\/537.36",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/src\/settings.py HTTP\/1.1",
"request_sample": "GET \/src\/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/src\/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like G",
"evidence": {
"method": "GET",
"path": "\/src\/settings.py",
"user_agent": "Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Safari\/537.36",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/src\/settings.py HTTP\/1.1",
"request_sample": "GET \/src\/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/src\/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like G",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "69b3cd007b9ec9203dc7896c99f6cf628c7e317b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/settings.py",
"request_line": "GET \/src\/settings.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/src\/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like G",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/settings.py",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 56,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/settings.py",
"request_line": "GET \/src\/settings.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/settings.py",
"evidence_snippet": "GET \/src\/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like G",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 56 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /private.json
Élevée
Moyen · 54
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /private.json UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/537…
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
net_flood
Cible HTTP
GET
/private.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/private.json
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /private.json HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3889.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /private.json HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/537.3
Requête brute (extrait)
GET /private.json HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3889.0 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "json",
"http_ua_hash": "8793643e44c742c7c3494748b04f5af3aeb6f346",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "cba94a1b37f4bc1c6667e76235119ed3064bd656",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 251,
"payload_entropy": 5.424944788852072,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 60,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 54,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "46b38a66c1d5f50cf15dd70a9739194f116117c8",
"event_fingerprint": "8c5f7aa801a251c1f800191041adc9cc8d7b4d3d",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f5b20f13cb0f7e3d9597b6ef1bf377f2",
"payload_hash": "148de314bfe91d7a54c7f58ea48f12dd",
"path_pattern_hash": "45bc7fdb4d234c918d3617f96e56d2a9"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/private.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.3",
"method": "GET",
"path": "\/private.json",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3889.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/private.json HTTP\/1.1",
"request_sample": "GET \/private.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3889.0 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/private.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.3",
"evidence": {
"method": "GET",
"path": "\/private.json",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3889.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/private.json HTTP\/1.1",
"request_sample": "GET \/private.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3889.0 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/private.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.3",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1db5b7574dee821e3e099ade553fea68bead0d9d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/private.json",
"request_line": "GET \/private.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3889.0 Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/private.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.3",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/private.json",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/private.json",
"request_line": "GET \/private.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3889.0 Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/private.json",
"evidence_snippet": "GET \/private.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.3",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · TLS
Sonde PostgreSQL
postgres probe · via TLS:9900 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
9900
Chemin / cible
—
Service
TLS
Payload
� �Hנ��ݳ��u�����c�琌<�l����� [g�oh�s�M8�E=4=�| ט'�z�j� &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �Hנ��ݳ��u�����c�琌<�l����� [g�oh�s�M8�E=4=�| ט'�z�j� &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� �Hנ��ݳ��u�����c�琌<�l����� [g�oh�s�M8�E=4=�| ט'�z�j� &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ J�����4%��&�1�q� �ǀ�5ݭ�y
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.860215209488503,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9bc6e9422076201846bf3268f1c965cbd91f8034",
"event_fingerprint": "494c9f1d51d87e4e628444cc1ac6318d28c9083c",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "417eb7c44b20ed85551388741d14f164",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9900,
"service": "tls",
"service_name": "tls",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003H\u05e0\u0007\ufffd\ufffd\u0773\ufffd\ufffdu\ufffd\u0003\ufffd\ufffd\ufffd\ufffdc\ufffd\u740c<\ufffdl\ufffd\ufffd\ufffd\u0004\ufffd\ufffd [g\ufffdoh\ufffds\ufffd\u001aM8\ufffdE=4=\ufffd|\t\u05d8\u0018'\u001a\u0001\ufffdz\ufffdj\ufffd\u0010\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003H\u05e0\u0007\ufffd\ufffd\u0773\ufffd\ufffdu\ufffd\u0003\ufffd\ufffd\ufffd\ufffdc\ufffd\u740c<\ufffdl\ufffd\ufffd\ufffd\u0004\ufffd\ufffd [g\ufffdoh\ufffds\ufffd\u001aM8\ufffdE=4=\ufffd|\t\u05d8\u0018'\u001a\u0001\ufffdz\ufffdj\ufffd\u0010\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 J\ufffd\ufffd\ufffd\ufffd\ufffd4%\ufffd\ufffd\u0004&\ufffd1\u0015\u0004\ufffd\u0017q\ufffd \ufffd\u01c0\ufffd5\u076d\ufffdy",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003H\u05e0\u0007\ufffd\ufffd\u0773\ufffd\ufffdu\ufffd\u0003\ufffd\ufffd\ufffd\ufffdc\ufffd\u740c<\ufffdl\ufffd\ufffd\ufffd\u0004\ufffd\ufffd [g\ufffdoh\ufffds\ufffd\u001aM8\ufffdE=4=\ufffd|\t\u05d8\u0018'\u001a\u0001\ufffdz\ufffdj\ufffd\u0010\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b3f58aa0aed7edb9723c61677e2335e6a2df1eff",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003H\u05e0\u0007\ufffd\ufffd\u0773\ufffd\ufffdu\ufffd\u0003\ufffd\ufffd\ufffd\ufffdc\ufffd\u740c<\ufffdl\ufffd\ufffd\ufffd\u0004\ufffd\ufffd [g\ufffdoh\ufffds\ufffd\u001aM8\ufffdE=4=\ufffd|\t\u05d8\u0018'\u001a\u0001\ufffdz\ufffdj\ufffd\u0010\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9900,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdH\u05e0\ufffd\ufffd\u0773\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffd\ufffdc\ufffd\u740c<\ufffdl\ufffd\ufffd\ufffd\ufffd\ufffd [g\ufffdoh\ufffds\ufffdM8\ufffdE=4=\ufffd|\t\u05d8'\ufffdz\ufffdj\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via TLS:9900 \u00b7 (sonde \/ probe)",
"target_port_label": "9900 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003H\u05e0\u0007\ufffd\ufffd\u0773\ufffd\ufffdu\ufffd\u0003\ufffd\ufffd\ufffd\ufffdc\ufffd\u740c<\ufffdl\ufffd\ufffd\ufffd\u0004\ufffd\ufffd [g\ufffdoh\ufffds\ufffd\u001aM8\ufffdE=4=\ufffd|\t\u05d8\u0018'\u001a\u0001\ufffdz\ufffdj\ufffd\u0010\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9900,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:9900 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdH\u05e0\ufffd\ufffd\u0773\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffd\ufffdc\ufffd\u740c<\ufffdl\ufffd\ufffd\ufffd\ufffd\ufffd [g\ufffdoh\ufffds\ufffdM8\ufffdE=4=\ufffd|\t\u05d8'\ufffdz\ufffdj\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "9900 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · TLS
Sonde PostgreSQL
postgres probe · via TLS:9900 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
9900
Chemin / cible
—
Service
TLS
Payload
� ����e���B�E��m��*ʩ���G&��H�@�G LO?��9�K��[��6E���.����>�{g &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����e���B�E��m��*ʩ���G&��H�@�G LO?��9�K��[��6E���.����>�{g &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� ����e���B�E��m��*ʩ���G&��H�@�G LO?��9�K��[��6E���.����>�{g &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ �����0( ۂg9ܛNJ��%X`Sɫ ���d��J
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.847748561000039,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9bc6e9422076201846bf3268f1c965cbd91f8034",
"event_fingerprint": "494c9f1d51d87e4e628444cc1ac6318d28c9083c",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "8bcb6ffe129bc02491ae5a07b304ff99",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9900,
"service": "tls",
"service_name": "tls",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0014\ufffd\ufffd\ufffde\ufffd\ufffd\ufffdB\ufffdE\ufffd\ufffdm\ufffd\ufffd*\u02a9\u0010\ufffd\ufffd\ufffdG&\ufffd\ufffdH\ufffd@\ufffdG LO\u000f?\ufffd\u0014\ufffd9\ufffdK\u000f\ufffd\ufffd[\ufffd\ufffd6E\ufffd\ufffd\ufffd.\u0014\ufffd\ufffd\ufffd\ufffd>\ufffd{g\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0014\ufffd\ufffd\ufffde\ufffd\ufffd\ufffdB\ufffdE\ufffd\ufffdm\ufffd\ufffd*\u02a9\u0010\ufffd\ufffd\ufffdG&\ufffd\ufffdH\ufffd@\ufffdG LO\u000f?\ufffd\u0014\ufffd9\ufffdK\u000f\ufffd\ufffd[\ufffd\ufffd6E\ufffd\ufffd\ufffd.\u0014\ufffd\ufffd\ufffd\ufffd>\ufffd{g\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffd\ufffd\ufffd0(\u0000\u06c2g9\u071b\u01ca\ufffd\ufffd%X`S\u026b\r\ufffd\ufffd\ufffdd\ufffd\ufffdJ",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0014\ufffd\ufffd\ufffde\ufffd\ufffd\ufffdB\ufffdE\ufffd\ufffdm\ufffd\ufffd*\u02a9\u0010\ufffd\ufffd\ufffdG&\ufffd\ufffdH\ufffd@\ufffdG LO\u000f?\ufffd\u0014\ufffd9\ufffdK\u000f\ufffd\ufffd[\ufffd\ufffd6E\ufffd\ufffd\ufffd.\u0014\ufffd\ufffd\ufffd\ufffd>\ufffd{g\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fd21c7f6cb4bfe36f0725d83ebe2223e9b5cdf58",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0014\ufffd\ufffd\ufffde\ufffd\ufffd\ufffdB\ufffdE\ufffd\ufffdm\ufffd\ufffd*\u02a9\u0010\ufffd\ufffd\ufffdG&\ufffd\ufffdH\ufffd@\ufffdG LO\u000f?\ufffd\u0014\ufffd9\ufffdK\u000f\ufffd\ufffd[\ufffd\ufffd6E\ufffd\ufffd\ufffd.\u0014\ufffd\ufffd\ufffd\ufffd>\ufffd{g\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9900,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd\ufffd\ufffdB\ufffdE\ufffd\ufffdm\ufffd\ufffd*\u02a9\ufffd\ufffd\ufffdG&\ufffd\ufffdH\ufffd@\ufffdG LO?\ufffd\ufffd9\ufffdK\ufffd\ufffd[\ufffd\ufffd6E\ufffd\ufffd\ufffd.\ufffd\ufffd\ufffd\ufffd>\ufffd{g&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via TLS:9900 \u00b7 (sonde \/ probe)",
"target_port_label": "9900 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0014\ufffd\ufffd\ufffde\ufffd\ufffd\ufffdB\ufffdE\ufffd\ufffdm\ufffd\ufffd*\u02a9\u0010\ufffd\ufffd\ufffdG&\ufffd\ufffdH\ufffd@\ufffdG LO\u000f?\ufffd\u0014\ufffd9\ufffdK\u000f\ufffd\ufffd[\ufffd\ufffd6E\ufffd\ufffd\ufffd.\u0014\ufffd\ufffd\ufffd\ufffd>\ufffd{g\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9900,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:9900 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd\ufffd\ufffdB\ufffdE\ufffd\ufffdm\ufffd\ufffd*\u02a9\ufffd\ufffd\ufffdG&\ufffd\ufffdH\ufffd@\ufffdG LO?\ufffd\ufffd9\ufffdK\ufffd\ufffd[\ufffd\ufffd6E\ufffd\ufffd\ufffd.\ufffd\ufffd\ufffd\ufffd>\ufffd{g&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "9900 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /secret.json
Élevée
Moyen · 54
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /secret.json UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
net_flood
Cible HTTP
GET
/secret.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/secret.json
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /secret.json HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 OPR/62.0.3331.116
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /secret.json HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Ge
Requête brute (extrait)
GET /secret.json HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 OPR/62.0.3331.116 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "json",
"http_ua_hash": "ab6be472386c2a172145f5ee25f450ea8a5c0f51",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "11f90d09ab2be62b71e86ff2300d82bf95914c93",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 254,
"payload_entropy": 5.45293959376299,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 60,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 54,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ab365d42c3be419a302bd36884349763b3705600",
"event_fingerprint": "2513e9dc80e28c92f0ab322f4ae60a2ac4e128e5",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7a059e686bc1fefbc7768bdfc19134e4",
"payload_hash": "d1d9ff70ed6369283a28bef78768e137",
"path_pattern_hash": "b9a820ca8b2e17563e04a37bc3cb0c35"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/secret.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Ge",
"method": "GET",
"path": "\/secret.json",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36 OPR\/62.0.3331.116",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/secret.json HTTP\/1.1",
"request_sample": "GET \/secret.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36 OPR\/62.0.3331.116\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/secret.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Ge",
"evidence": {
"method": "GET",
"path": "\/secret.json",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36 OPR\/62.0.3331.116",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/secret.json HTTP\/1.1",
"request_sample": "GET \/secret.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36 OPR\/62.0.3331.116\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/secret.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Ge",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d8cb1cc9b9ed079194e658d183a19777e140678c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/secret.json",
"request_line": "GET \/secret.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36 OPR\/62.0.3331\u2026",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/secret.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Ge",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/secret.json",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/secret.json",
"request_line": "GET \/secret.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36 OPR\/62.0.3331\u2026",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/secret.json",
"evidence_snippet": "GET \/secret.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Ge",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /keys.json
Élevée
Moyen · 54
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /keys.json UA Mozilla/5.0 (iPhone; CPU iPhone OS 12_3 like Mac OS X) AppleWeb…
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
net_flood
Cible HTTP
GET
/keys.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/keys.json
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /keys.json HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 12_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/75.0.3770.103 Mobile/15E148 Safari/605.1
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /keys.json HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_3 like Mac OS X) AppleWebKit/6
Requête brute (extrait)
GET /keys.json HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/75.0.3770.103 Mobile/15E148 Safari/605.1 Accept-Charset: utf-8 Accept-Encoding: gzip Connec
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "json",
"http_ua_hash": "4fc70ddd732570bc60748e141fe15b6a888a584e",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "c3ac892564a71141581a4e5efe8d4174457be60d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 271,
"payload_entropy": 5.404871131344395,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 60,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 54,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "46b38a66c1d5f50cf15dd70a9739194f116117c8",
"event_fingerprint": "d1d637c70dce8836264ed9f8506dc45b6a0660c1",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "05cb8061a6d3bac94d637c6509a58057",
"payload_hash": "8040e40b35f5696bbcee89c7511c77b2",
"path_pattern_hash": "ac1c8497c117520986c9f2f44ae6cfa7"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/keys.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_3 like Mac OS X) AppleWebKit\/6",
"method": "GET",
"path": "\/keys.json",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 12_3 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/75.0.3770.103 Mobile\/15E148 Safari\/605.1",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/keys.json HTTP\/1.1",
"request_sample": "GET \/keys.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_3 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/75.0.3770.103 Mobile\/15E148 Safari\/605.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnec",
"payload_snippet": "GET \/keys.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_3 like Mac OS X) AppleWebKit\/6",
"evidence": {
"method": "GET",
"path": "\/keys.json",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 12_3 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/75.0.3770.103 Mobile\/15E148 Safari\/605.1",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/keys.json HTTP\/1.1",
"request_sample": "GET \/keys.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_3 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/75.0.3770.103 Mobile\/15E148 Safari\/605.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnec",
"payload_snippet": "GET \/keys.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_3 like Mac OS X) AppleWebKit\/6",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "24f8244c58e39b78804b007eb48fdeb431803165",
"protocol_details": {
"http_method": "GET",
"http_path": "\/keys.json",
"request_line": "GET \/keys.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 12_3 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/75.0.3770.103 Mob\u2026",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/keys.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_3 like Mac OS X) AppleWebKit\/6",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/keys.json",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/keys.json",
"request_line": "GET \/keys.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 12_3 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/75.0.3770.103 Mob\u2026",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/keys.json",
"evidence_snippet": "GET \/keys.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_3 like Mac OS X) AppleWebKit\/6",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /api/config.yml
Élevée
Moyen · 60
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /api/config.yml UA ELinks (0.4pre5; Linux 2.6.10-ac7 i686; 80x33)
Émulateur
HTTP
WAF
17
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950600:k8s-api
http_probe_api
Cible HTTP
GET
/api/config.yml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/api/config.yml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 60
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /api/config.yml HTTP/1.1
User-Agent
ELinks (0.4pre5; Linux 2.6.10-ac7 i686; 80x33)
Règles WAF
rce-0
nosqli-3
k8s-api
Payload (extrait)
GET /api/config.yml HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: ELinks (0.4pre5; Linux 2.6.10-ac7 i686; 80x33)
Accept-Charset:
Requête brute (extrait)
GET /api/config.yml HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: ELinks (0.4pre5; Linux 2.6.10-ac7 i686; 80x33) Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "yml",
"http_ua_hash": "62d6204c15d46fcb9ff08a8fc82de4e98db83842",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "4744e451f0e5837e40fea15eeae656c670359c61",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 180,
"payload_entropy": 5.269410650074887,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 76,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 76,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 60,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "4e5067ae3a12b9f8926d866f9353e8965b6a0b81",
"event_fingerprint": "8dcf89394ba0949251a430e013dd5789237a1bf6",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 76,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f01676b341b451b95810b4aded6359b1",
"payload_hash": "42fd2f1249adabc80e6c663d4dc191de",
"path_pattern_hash": "1d6a542ea609410a54ba728eccda5c8b"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "GET \/api\/config.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: ELinks (0.4pre5; Linux 2.6.10-ac7 i686; 80x33)\r\nAccept-Charset:",
"method": "GET",
"path": "\/api\/config.yml",
"user_agent": "ELinks (0.4pre5; Linux 2.6.10-ac7 i686; 80x33)",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"k8s-api"
],
"request_line": "GET \/api\/config.yml HTTP\/1.1",
"request_sample": "GET \/api\/config.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: ELinks (0.4pre5; Linux 2.6.10-ac7 i686; 80x33)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/api\/config.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: ELinks (0.4pre5; Linux 2.6.10-ac7 i686; 80x33)\r\nAccept-Charset:",
"evidence": {
"method": "GET",
"path": "\/api\/config.yml",
"user_agent": "ELinks (0.4pre5; Linux 2.6.10-ac7 i686; 80x33)",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"k8s-api"
],
"request_line": "GET \/api\/config.yml HTTP\/1.1",
"request_sample": "GET \/api\/config.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: ELinks (0.4pre5; Linux 2.6.10-ac7 i686; 80x33)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/api\/config.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: ELinks (0.4pre5; Linux 2.6.10-ac7 i686; 80x33)\r\nAccept-Charset:",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9cb1df427d2fccb859889b58b9befbf88f5935b2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/config.yml",
"request_line": "GET \/api\/config.yml HTTP\/1.1",
"http_user_agent": "ELinks (0.4pre5; Linux 2.6.10-ac7 i686; 80x33)",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/config.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: ELinks (0.4pre5; Linux 2.6.10-ac7 i686; 80x33)\r\nAccept-Charset:",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/config.yml",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 76,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/config.yml",
"request_line": "GET \/api\/config.yml HTTP\/1.1",
"http_user_agent": "ELinks (0.4pre5; Linux 2.6.10-ac7 i686; 80x33)",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/config.yml",
"evidence_snippet": "GET \/api\/config.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: ELinks (0.4pre5; Linux 2.6.10-ac7 i686; 80x33)\r\nAccept-Charset:",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 76 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950600:k8s-api",
"http_probe_api",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /secrets.yaml
Élevée
Moyen · 54
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /secrets.yaml UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
http_k8s_probe
net_flood
Cible HTTP
GET
/secrets.yaml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/secrets.yaml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /secrets.yaml HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.62 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /secrets.yaml HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like G
Requête brute (extrait)
GET /secrets.yaml HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.62 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yaml",
"http_ua_hash": "34594b98bc39a72140f9a7f17c6c09103918c77f",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "bed465ef7b10319d6adf1a5770456b92d16890b0",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 236,
"payload_entropy": 5.441324216557424,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 60,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 54,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f12473fdefb6663fc0bf3f2d2b03efa008bb6c15",
"event_fingerprint": "dcf1a43f92931da220a91d37989b18e17429be95",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "b48d1760e16bd07a7fe3a1df8475b3b4",
"payload_hash": "e3e0d024db2060b714400a3ea9c6651d",
"path_pattern_hash": "48d0edff0af203e37d12a3776eddc53f"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/secrets.yaml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like G",
"method": "GET",
"path": "\/secrets.yaml",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/67.0.3396.62 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/secrets.yaml HTTP\/1.1",
"request_sample": "GET \/secrets.yaml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/67.0.3396.62 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/secrets.yaml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like G",
"evidence": {
"method": "GET",
"path": "\/secrets.yaml",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/67.0.3396.62 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/secrets.yaml HTTP\/1.1",
"request_sample": "GET \/secrets.yaml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/67.0.3396.62 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/secrets.yaml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like G",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d6b94b462ce26a488fdbd9c47456f60818812e85",
"protocol_details": {
"http_method": "GET",
"http_path": "\/secrets.yaml",
"request_line": "GET \/secrets.yaml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/67.0.3396.62 Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/secrets.yaml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like G",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/secrets.yaml",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/secrets.yaml",
"request_line": "GET \/secrets.yaml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/67.0.3396.62 Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/secrets.yaml",
"evidence_snippet": "GET \/secrets.yaml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like G",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"http_k8s_probe",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9900 · (tentative d'exploit) · → /api/config.json
Élevée
Moyen · 59
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /api/config.json UA Mozilla/1.22 (compatible; MSIE 5.01; PalmOS 3.0) EudoraWeb 2.1
Émulateur
HTTP
WAF
17
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950600:k8s-api
http_probe_api
Cible HTTP
GET
/api/config.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/api/config.json
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /api/config.json HTTP/1.1
User-Agent
Mozilla/1.22 (compatible; MSIE 5.01; PalmOS 3.0) EudoraWeb 2.1
Règles WAF
rce-0
nosqli-3
k8s-api
Payload (extrait)
GET /api/config.json HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/1.22 (compatible; MSIE 5.01; PalmOS 3.0) EudoraWeb 2.1
Requête brute (extrait)
GET /api/config.json HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/1.22 (compatible; MSIE 5.01; PalmOS 3.0) EudoraWeb 2.1 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "964f0361d4e043d42a0314c4bafe9f6c73442dff",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "23a7fdebb2c6a62d7d99ec7e14a583ee335f985b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 197,
"payload_entropy": 5.295163021755049,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 76,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 76,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 59,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "da5f8d3030eeb415dcf921c5fd6b05776106239b",
"event_fingerprint": "65e61faa61948ea8a13bc43e47bf2584a9322e5a",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 76,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "cfa9df766df352ee0c2ee76a6124a01b",
"payload_hash": "786054879509aab230150376310a3aa4",
"path_pattern_hash": "cccb8d748e9f900a4a8cbc953ef4ca7f"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "GET \/api\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/1.22 (compatible; MSIE 5.01; PalmOS 3.0) EudoraWeb 2.1",
"method": "GET",
"path": "\/api\/config.json",
"user_agent": "Mozilla\/1.22 (compatible; MSIE 5.01; PalmOS 3.0) EudoraWeb 2.1",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"k8s-api"
],
"request_line": "GET \/api\/config.json HTTP\/1.1",
"request_sample": "GET \/api\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/1.22 (compatible; MSIE 5.01; PalmOS 3.0) EudoraWeb 2.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/api\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/1.22 (compatible; MSIE 5.01; PalmOS 3.0) EudoraWeb 2.1",
"evidence": {
"method": "GET",
"path": "\/api\/config.json",
"user_agent": "Mozilla\/1.22 (compatible; MSIE 5.01; PalmOS 3.0) EudoraWeb 2.1",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"k8s-api"
],
"request_line": "GET \/api\/config.json HTTP\/1.1",
"request_sample": "GET \/api\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/1.22 (compatible; MSIE 5.01; PalmOS 3.0) EudoraWeb 2.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/api\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/1.22 (compatible; MSIE 5.01; PalmOS 3.0) EudoraWeb 2.1",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a020b5bd0ac31a49e484c7d5c594d71c9cc2281f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/config.json",
"request_line": "GET \/api\/config.json HTTP\/1.1",
"http_user_agent": "Mozilla\/1.22 (compatible; MSIE 5.01; PalmOS 3.0) EudoraWeb 2.1",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/1.22 (compatible; MSIE 5.01; PalmOS 3.0) EudoraWeb 2.1",
"attack_vector": "config file probe \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/config.json",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 76,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/config.json",
"request_line": "GET \/api\/config.json HTTP\/1.1",
"http_user_agent": "Mozilla\/1.22 (compatible; MSIE 5.01; PalmOS 3.0) EudoraWeb 2.1",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/config.json",
"evidence_snippet": "GET \/api\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/1.22 (compatible; MSIE 5.01; PalmOS 3.0) EudoraWeb 2.1",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 76 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950600:k8s-api",
"http_probe_api",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · TLS
Sonde PostgreSQL
postgres probe · via TLS:9900 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
9900
Chemin / cible
—
Service
TLS
Payload
� �+���#h��_���δ� aR���]��5G[�Q }Kd$�Q|Ypl�_w#�Л��Yi �ƚ�� &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �+���#h��_���δ� aR���]��5G[�Q }Kd$�Q|Ypl�_w#�Л��Yi �ƚ�� &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� �+���#h��_���δ� aR���]��5G[�Q }Kd$�Q|Ypl�_w#�Л��Yi �ƚ�� &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ o��؟1���l�o ��_�)�n�����f���T
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.774342932721732,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9bc6e9422076201846bf3268f1c965cbd91f8034",
"event_fingerprint": "494c9f1d51d87e4e628444cc1ac6318d28c9083c",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "69a2f09bd6aabd830cbb7a107dbe5e6a",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9900,
"service": "tls",
"service_name": "tls",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003+\ufffd\ufffd\ufffd#h\ufffd\ufffd_\u0006\ufffd\ufffd\ufffd\u03b4\ufffd\taR\ufffd\ufffd\ufffd]\ufffd\b\ufffd5\u0006G[\ufffdQ }\u0019Kd$\ufffdQ\u0003|\bYpl\ufffd_w#\ufffd\u041b\ufffd\ufffdYi\u000e\t\ufffd\u0012\u019a\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003+\ufffd\ufffd\ufffd#h\ufffd\ufffd_\u0006\ufffd\ufffd\ufffd\u03b4\ufffd\taR\ufffd\ufffd\ufffd]\ufffd\b\ufffd5\u0006G[\ufffdQ }\u0019Kd$\ufffdQ\u0003|\bYpl\ufffd_w#\ufffd\u041b\ufffd\ufffdYi\u000e\t\ufffd\u0012\u019a\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 o\ufffd\ufffd\u061f\b1\ufffd\ufffd\ufffdl\ufffdo\u000b\ufffd\ufffd_\ufffd)\ufffdn\ufffd\ufffd\ufffd\ufffd\ufffd\u0017f\ufffd\ufffd\ufffdT",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003+\ufffd\ufffd\ufffd#h\ufffd\ufffd_\u0006\ufffd\ufffd\ufffd\u03b4\ufffd\taR\ufffd\ufffd\ufffd]\ufffd\b\ufffd5\u0006G[\ufffdQ }\u0019Kd$\ufffdQ\u0003|\bYpl\ufffd_w#\ufffd\u041b\ufffd\ufffdYi\u000e\t\ufffd\u0012\u019a\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "832d1b332de88d8aea45db4a4c7d591d1c9a37a2",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003+\ufffd\ufffd\ufffd#h\ufffd\ufffd_\u0006\ufffd\ufffd\ufffd\u03b4\ufffd\taR\ufffd\ufffd\ufffd]\ufffd\b\ufffd5\u0006G[\ufffdQ }\u0019Kd$\ufffdQ\u0003|\bYpl\ufffd_w#\ufffd\u041b\ufffd\ufffdYi\u000e\t\ufffd\u0012\u019a\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9900,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd+\ufffd\ufffd\ufffd#h\ufffd\ufffd_\ufffd\ufffd\ufffd\u03b4\ufffd\taR\ufffd\ufffd\ufffd]\ufffd\ufffd5G[\ufffdQ }Kd$\ufffdQ|Ypl\ufffd_w#\ufffd\u041b\ufffd\ufffdYi\t\ufffd\u019a\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via TLS:9900 \u00b7 (sonde \/ probe)",
"target_port_label": "9900 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003+\ufffd\ufffd\ufffd#h\ufffd\ufffd_\u0006\ufffd\ufffd\ufffd\u03b4\ufffd\taR\ufffd\ufffd\ufffd]\ufffd\b\ufffd5\u0006G[\ufffdQ }\u0019Kd$\ufffdQ\u0003|\bYpl\ufffd_w#\ufffd\u041b\ufffd\ufffdYi\u000e\t\ufffd\u0012\u019a\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9900,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:9900 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd+\ufffd\ufffd\ufffd#h\ufffd\ufffd_\ufffd\ufffd\ufffd\u03b4\ufffd\taR\ufffd\ufffd\ufffd]\ufffd\ufffd5G[\ufffdQ }Kd$\ufffdQ|Ypl\ufffd_w#\ufffd\u041b\ufffd\ufffdYi\t\ufffd\u019a\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "9900 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /api-keys.json
Élevée
Moyen · 54
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /api-keys.json UA Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, …
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
net_flood
Cible HTTP
GET
/api-keys.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/api-keys.json
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /api-keys.json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /api-keys.json HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, l
Requête brute (extrait)
GET /api-keys.json HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "json",
"http_ua_hash": "b69e2c055646bf42e2f0c628cd872d6c34edb137",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "c66ed2cb2ee7945e15913f0f7ca32c846f13537b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 242,
"payload_entropy": 5.430716326888232,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 60,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 54,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "46b38a66c1d5f50cf15dd70a9739194f116117c8",
"event_fingerprint": "e44d1d14bd41ddf529014c2b5508102068882329",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63ac453956c024317dd5cf94c0ac969b",
"payload_hash": "2b57dcaefa6d67eb520565abfb36511b",
"path_pattern_hash": "015c5a8e5b64863b9df5b863319a5c2b"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/api-keys.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, l",
"method": "GET",
"path": "\/api-keys.json",
"user_agent": "Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/api-keys.json HTTP\/1.1",
"request_sample": "GET \/api-keys.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/api-keys.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, l",
"evidence": {
"method": "GET",
"path": "\/api-keys.json",
"user_agent": "Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/api-keys.json HTTP\/1.1",
"request_sample": "GET \/api-keys.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/api-keys.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, l",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e6ca967fac6d05d2f6ea9cd14956ba50b6d9d263",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api-keys.json",
"request_line": "GET \/api-keys.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api-keys.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, l",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api-keys.json",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api-keys.json",
"request_line": "GET \/api-keys.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api-keys.json",
"evidence_snippet": "GET \/api-keys.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, l",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /api/settings.yml
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /api/settings.yml UA Mozilla/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X; da-d…
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950600:k8s-api
Cible HTTP
GET
/api/settings.yml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/api/settings.yml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /api/settings.yml HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X; da-dk) AppleWebKit/534.46.0 (KHTML, like Gecko) CriOS/19.0.1084.60 Mobile/9B206 Safari/7534.48.3
Règles WAF
rce-0
nosqli-3
k8s-api
Payload (extrait)
GET /api/settings.yml HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X; da
Requête brute (extrait)
GET /api/settings.yml HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X; da-dk) AppleWebKit/534.46.0 (KHTML, like Gecko) CriOS/19.0.1084.60 Mobile/9B206 Safari/7534.48.3 Accept-Charset: utf-8 Accept-En
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "yml",
"http_ua_hash": "070766d822f3ae79d339a01ac7e2a8d026922a6b",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "ca1a81175cd9e58e9e1d76706220c73a85edea6c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 291,
"payload_entropy": 5.455844108375649,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "fde09ba564a8a11f5b5f64aad2d6a091ee070279",
"event_fingerprint": "2a3f9ec5b28be4226e5e6a28e733453ca4ad90b4",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3291cc6611a68cd117de00faf9944f4f",
"payload_hash": "bc8bc722a8e62a1f4274f6f794ea837c",
"path_pattern_hash": "bf4cbe1c6a04f0ce19969bc5a096ab48"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/api\/settings.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X; da",
"method": "GET",
"path": "\/api\/settings.yml",
"user_agent": "Mozilla\/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X; da-dk) AppleWebKit\/534.46.0 (KHTML, like Gecko) CriOS\/19.0.1084.60 Mobile\/9B206 Safari\/7534.48.3",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"k8s-api"
],
"request_line": "GET \/api\/settings.yml HTTP\/1.1",
"request_sample": "GET \/api\/settings.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X; da-dk) AppleWebKit\/534.46.0 (KHTML, like Gecko) CriOS\/19.0.1084.60 Mobile\/9B206 Safari\/7534.48.3\r\nAccept-Charset: utf-8\r\nAccept-En",
"payload_snippet": "GET \/api\/settings.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X; da",
"evidence": {
"method": "GET",
"path": "\/api\/settings.yml",
"user_agent": "Mozilla\/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X; da-dk) AppleWebKit\/534.46.0 (KHTML, like Gecko) CriOS\/19.0.1084.60 Mobile\/9B206 Safari\/7534.48.3",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"k8s-api"
],
"request_line": "GET \/api\/settings.yml HTTP\/1.1",
"request_sample": "GET \/api\/settings.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X; da-dk) AppleWebKit\/534.46.0 (KHTML, like Gecko) CriOS\/19.0.1084.60 Mobile\/9B206 Safari\/7534.48.3\r\nAccept-Charset: utf-8\r\nAccept-En",
"payload_snippet": "GET \/api\/settings.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X; da",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7ce0b41fe856a490f7222bd80d1af96f43aef6f9",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/settings.yml",
"request_line": "GET \/api\/settings.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X; da-dk) AppleWebKit\/534.46.0 (KHTML, like Gecko) CriOS\/19.0.1\u2026",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/settings.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X; da",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/settings.yml",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/settings.yml",
"request_line": "GET \/api\/settings.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X; da-dk) AppleWebKit\/534.46.0 (KHTML, like Gecko) CriOS\/19.0.1\u2026",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/settings.yml",
"evidence_snippet": "GET \/api\/settings.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X; da",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api",
"http_probe_api",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /api/database.yml
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /api/database.yml UA Mozilla/5.0 (Linux; Android 9; SM-G960U) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950600:k8s-api
Cible HTTP
GET
/api/database.yml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/api/database.yml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Database YAML
Ligne de requête
GET /api/database.yml HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; SM-G960U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
k8s-api
Payload (extrait)
GET /api/database.yml HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (Linux; Android 9; SM-G960U) AppleWebKit/537.36 (
Requête brute (extrait)
GET /api/database.yml HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (Linux; Android 9; SM-G960U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "yml",
"http_ua_hash": "4514010d1c861fb109480127dbf6ae2989d67e77",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "c7925f5b0f216247bb0a000827dd8b1a02615d1d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 257,
"payload_entropy": 5.42472376662053,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "fde09ba564a8a11f5b5f64aad2d6a091ee070279",
"event_fingerprint": "682072305a98870e20d247fd5f351ae40bab934a",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0474"
],
"matched_pattern_names": [
"Cred Database YAML"
],
"pattern_ids": [
"pat-0474"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e3f6b886cb1e47721b07ce96d2990f88",
"payload_hash": "8e4549df4bf144404475a736a9644196",
"path_pattern_hash": "a85c0cffdce7f3cd5f8342a635486f8c"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/api\/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G960U) AppleWebKit\/537.36 (",
"method": "GET",
"path": "\/api\/database.yml",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; SM-G960U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"k8s-api"
],
"request_line": "GET \/api\/database.yml HTTP\/1.1",
"request_sample": "GET \/api\/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G960U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r",
"payload_snippet": "GET \/api\/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G960U) AppleWebKit\/537.36 (",
"evidence": {
"method": "GET",
"path": "\/api\/database.yml",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; SM-G960U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"k8s-api"
],
"request_line": "GET \/api\/database.yml HTTP\/1.1",
"request_sample": "GET \/api\/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G960U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r",
"payload_snippet": "GET \/api\/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G960U) AppleWebKit\/537.36 (",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c1746c29a713a8e2425f01fdb1b10ed9dc8285d7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/database.yml",
"request_line": "GET \/api\/database.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; SM-G960U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.\u2026",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G960U) AppleWebKit\/537.36 (",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/database.yml",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/database.yml",
"request_line": "GET \/api\/database.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; SM-G960U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.\u2026",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/database.yml",
"evidence_snippet": "GET \/api\/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G960U) AppleWebKit\/537.36 (",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api",
"http_probe_api",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · TLS
Sonde PostgreSQL
postgres probe · via TLS:9900 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
9900
Chemin / cible
—
Service
TLS
Payload
� ������wn�z�]=����x����0�W�K >Զp�ɽ1������%�� �pAU<!����K�� &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ������wn�z�]=����x����0�W�K >Զp�ɽ1������%�� �pAU<!����K�� &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� ������wn�z�]=����x����0�W�K >Զp�ɽ1������%�� �pAU<!����K�� &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ �o� L�>KRm��Q� ����Oh�L��'
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.808292366141545,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9bc6e9422076201846bf3268f1c965cbd91f8034",
"event_fingerprint": "494c9f1d51d87e4e628444cc1ac6318d28c9083c",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "07d7177be300794087f9418e94d2ced4",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9900,
"service": "tls",
"service_name": "tls",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0001\ufffd\ufffd\u0019\u0002wn\ufffdz\ufffd]=\ufffd\ufffd\ufffd\b\ufffdx\ufffd\ufffd\ufffd\ufffd0\u001a\b\ufffdW\ufffdK >\u0536p\ufffd\u027d1\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffd \ufffdpAU<!\ufffd\ufffd\ufffd\ufffdK\ufffd\ufffd\u0001\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0001\ufffd\ufffd\u0019\u0002wn\ufffdz\ufffd]=\ufffd\ufffd\ufffd\b\ufffdx\ufffd\ufffd\ufffd\ufffd0\u001a\b\ufffdW\ufffdK >\u0536p\ufffd\u027d1\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffd \ufffdpAU<!\ufffd\ufffd\ufffd\ufffdK\ufffd\ufffd\u0001\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdo\ufffd\u0000L\ufffd>KRm\ufffd\ufffd\u0016Q\ufffd\u001c\ufffd\ufffd\ufffd\u0014\ufffd\u0014Oh\ufffdL\ufffd\u000e\ufffd'\u001e",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0001\ufffd\ufffd\u0019\u0002wn\ufffdz\ufffd]=\ufffd\ufffd\ufffd\b\ufffdx\ufffd\ufffd\ufffd\ufffd0\u001a\b\ufffdW\ufffdK >\u0536p\ufffd\u027d1\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffd \ufffdpAU<!\ufffd\ufffd\ufffd\ufffdK\ufffd\ufffd\u0001\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3f2c3e3ebd527d461f4bd57e6b8b366a5b50e1ff",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0001\ufffd\ufffd\u0019\u0002wn\ufffdz\ufffd]=\ufffd\ufffd\ufffd\b\ufffdx\ufffd\ufffd\ufffd\ufffd0\u001a\b\ufffdW\ufffdK >\u0536p\ufffd\u027d1\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffd \ufffdpAU<!\ufffd\ufffd\ufffd\ufffdK\ufffd\ufffd\u0001\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9900,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdwn\ufffdz\ufffd]=\ufffd\ufffd\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffd0\ufffdW\ufffdK >\u0536p\ufffd\u027d1\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffd \ufffdpAU<!\ufffd\ufffd\ufffd\ufffdK\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via TLS:9900 \u00b7 (sonde \/ probe)",
"target_port_label": "9900 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0001\ufffd\ufffd\u0019\u0002wn\ufffdz\ufffd]=\ufffd\ufffd\ufffd\b\ufffdx\ufffd\ufffd\ufffd\ufffd0\u001a\b\ufffdW\ufffdK >\u0536p\ufffd\u027d1\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffd \ufffdpAU<!\ufffd\ufffd\ufffd\ufffdK\ufffd\ufffd\u0001\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9900,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:9900 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdwn\ufffdz\ufffd]=\ufffd\ufffd\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffd0\ufffdW\ufffdK >\u0536p\ufffd\u027d1\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffd \ufffdpAU<!\ufffd\ufffd\ufffd\ufffdK\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "9900 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /api_keys.yml
Élevée
Moyen · 54
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /api_keys.yml UA Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWeb…
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
net_flood
Cible HTTP
GET
/api_keys.yml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/api_keys.yml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /api_keys.yml HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/602.1.50 (KHTML, like Gecko) CriOS/56.0.2924.79 Mobile/16G77 Safari/602.1
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /api_keys.yml HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKi
Requête brute (extrait)
GET /api_keys.yml HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/602.1.50 (KHTML, like Gecko) CriOS/56.0.2924.79 Mobile/16G77 Safari/602.1 Accept-Charset: utf-8 Accept-Encoding: gzip Conne
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yml",
"http_ua_hash": "dc92e4b6e6561786f310ee928eb717ea913d334f",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "b1b0ece8c60b688b45eb0e1d24e20b9eba285b7f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 272,
"payload_entropy": 5.440688506160207,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 60,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 54,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "46b38a66c1d5f50cf15dd70a9739194f116117c8",
"event_fingerprint": "0f831236ce13186f981c20b8b8b22080bee2d0f5",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "15838926d1e30238f7398502825fb86d",
"payload_hash": "ee102aa599027c7b74166ca428a515f8",
"path_pattern_hash": "5ca9a05c1d66736244e2d5f5eca525aa"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/api_keys.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKi",
"method": "GET",
"path": "\/api_keys.yml",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit\/602.1.50 (KHTML, like Gecko) CriOS\/56.0.2924.79 Mobile\/16G77 Safari\/602.1",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/api_keys.yml HTTP\/1.1",
"request_sample": "GET \/api_keys.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit\/602.1.50 (KHTML, like Gecko) CriOS\/56.0.2924.79 Mobile\/16G77 Safari\/602.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConne",
"payload_snippet": "GET \/api_keys.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKi",
"evidence": {
"method": "GET",
"path": "\/api_keys.yml",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit\/602.1.50 (KHTML, like Gecko) CriOS\/56.0.2924.79 Mobile\/16G77 Safari\/602.1",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/api_keys.yml HTTP\/1.1",
"request_sample": "GET \/api_keys.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit\/602.1.50 (KHTML, like Gecko) CriOS\/56.0.2924.79 Mobile\/16G77 Safari\/602.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConne",
"payload_snippet": "GET \/api_keys.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKi",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "92ca859bdd1b0df7d179fb35e0fc89e74584a104",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api_keys.yml",
"request_line": "GET \/api_keys.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit\/602.1.50 (KHTML, like Gecko) CriOS\/56.0.2924.79 Mobi\u2026",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api_keys.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKi",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api_keys.yml",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api_keys.yml",
"request_line": "GET \/api_keys.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit\/602.1.50 (KHTML, like Gecko) CriOS\/56.0.2924.79 Mobi\u2026",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api_keys.yml",
"evidence_snippet": "GET \/api_keys.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKi",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /api/application.yml
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /api/application.yml UA Mozilla/5.0 (Linux; Android 9; POT-LX1) AppleWebKit/537.36 (KHT…
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950600:k8s-api
Cible HTTP
GET
/api/application.yml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/api/application.yml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /api/application.yml HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; POT-LX1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.101 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
k8s-api
Payload (extrait)
GET /api/application.yml HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (Linux; Android 9; POT-LX1) AppleWebKit/537.36
Requête brute (extrait)
GET /api/application.yml HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (Linux; Android 9; POT-LX1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.101 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "yml",
"http_ua_hash": "2f89b18a0fb3f37c2fd2178b67b70843d7dcbdcd",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "eaa807d97ed075164ad06a16fff4f79030561dd8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 259,
"payload_entropy": 5.414339816793499,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "fde09ba564a8a11f5b5f64aad2d6a091ee070279",
"event_fingerprint": "22833f62fe7aa8e9b614c64f7039e960833a393a",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e56f1f296709a8bccc2e6292dc59350e",
"payload_hash": "221039f9a011eff8e9cc3cff4c744c3f",
"path_pattern_hash": "f35df1fc019a96ac8898ec6340239854"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/api\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; POT-LX1) AppleWebKit\/537.36",
"method": "GET",
"path": "\/api\/application.yml",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; POT-LX1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.101 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"k8s-api"
],
"request_line": "GET \/api\/application.yml HTTP\/1.1",
"request_sample": "GET \/api\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; POT-LX1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.101 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r",
"payload_snippet": "GET \/api\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; POT-LX1) AppleWebKit\/537.36",
"evidence": {
"method": "GET",
"path": "\/api\/application.yml",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; POT-LX1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.101 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"k8s-api"
],
"request_line": "GET \/api\/application.yml HTTP\/1.1",
"request_sample": "GET \/api\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; POT-LX1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.101 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r",
"payload_snippet": "GET \/api\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; POT-LX1) AppleWebKit\/537.36",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "99ceed3148c9c13aeb833691e4d398c8cd0664ec",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/application.yml",
"request_line": "GET \/api\/application.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; POT-LX1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.101 Mobile Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; POT-LX1) AppleWebKit\/537.36",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/application.yml",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/application.yml",
"request_line": "GET \/api\/application.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; POT-LX1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.101 Mobile Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/application.yml",
"evidence_snippet": "GET \/api\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; POT-LX1) AppleWebKit\/537.36",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api",
"http_probe_api",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /api/parameters.yml
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /api/parameters.yml UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537…
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950600:k8s-api
Cible HTTP
GET
/api/parameters.yml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/api/parameters.yml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /api/parameters.yml HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.35 Safari/537.36
Règles WAF
rce-0
nosqli-3
k8s-api
Payload (extrait)
GET /api/parameters.yml HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit
Requête brute (extrait)
GET /api/parameters.yml HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.35 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "yml",
"http_ua_hash": "2b894689c4598dc38ad9ae0d881590961f587bc4",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "7911dc65ded0ff04acb5097887faf07b57d9f3ba",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 258,
"payload_entropy": 5.41246561761349,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "6eae19cfd7391164a006ab4e4c81d8c8ea88a6e8",
"event_fingerprint": "d02c61f8b3659fb62d725bcd6fc064d856bf7147",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f89139e348949b62ced355daef19c7ce",
"payload_hash": "3a5f86a96514407251fda30c987a7c44",
"path_pattern_hash": "25d742602b46e959c7961a08265c9c47"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/api\/parameters.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit",
"method": "GET",
"path": "\/api\/parameters.yml",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/77.0.3865.35 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"k8s-api"
],
"request_line": "GET \/api\/parameters.yml HTTP\/1.1",
"request_sample": "GET \/api\/parameters.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/77.0.3865.35 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n",
"payload_snippet": "GET \/api\/parameters.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit",
"evidence": {
"method": "GET",
"path": "\/api\/parameters.yml",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/77.0.3865.35 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"k8s-api"
],
"request_line": "GET \/api\/parameters.yml HTTP\/1.1",
"request_sample": "GET \/api\/parameters.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/77.0.3865.35 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n",
"payload_snippet": "GET \/api\/parameters.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e488784c2f866c3083212fc7158249d975b68ef6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/parameters.yml",
"request_line": "GET \/api\/parameters.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/77.0.3865.35 Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/parameters.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/parameters.yml",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/parameters.yml",
"request_line": "GET \/api\/parameters.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/77.0.3865.35 Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/parameters.yml",
"evidence_snippet": "GET \/api\/parameters.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api",
"http_probe_api",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /api/application.properties
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /api/application.properties UA Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950600:k8s-api
Cible HTTP
GET
/api/application.properties
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/api/application.properties
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /api/application.properties HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.84 Safari/537.36
Règles WAF
rce-0
nosqli-3
k8s-api
Payload (extrait)
GET /api/application.properties HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKi
Requête brute (extrait)
GET /api/application.properties HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.84 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "properties",
"http_ua_hash": "aa4a07d260b1b8159bdf96bbc777c3fe4fac0441",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "7b82037305b05e4852e4a0d12fe52171d45b0128",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 259,
"payload_entropy": 5.373593043426011,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "6eae19cfd7391164a006ab4e4c81d8c8ea88a6e8",
"event_fingerprint": "a2af6d224995f9a20ab9d14a2cdb47e5e1ec46b3",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "b8ad7130bd4353f4c54ae89dc22215f3",
"payload_hash": "2917bcc71e65f2086070fe88ae1bec9b",
"path_pattern_hash": "f658d71e5b555b6dd4035cc9acb8e173"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/api\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKi",
"method": "GET",
"path": "\/api\/application.properties",
"user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/68.0.3440.84 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"k8s-api"
],
"request_line": "GET \/api\/application.properties HTTP\/1.1",
"request_sample": "GET \/api\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/68.0.3440.84 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r",
"payload_snippet": "GET \/api\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKi",
"evidence": {
"method": "GET",
"path": "\/api\/application.properties",
"user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/68.0.3440.84 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"k8s-api"
],
"request_line": "GET \/api\/application.properties HTTP\/1.1",
"request_sample": "GET \/api\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/68.0.3440.84 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r",
"payload_snippet": "GET \/api\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKi",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8430a6bf205bcc55bb5f2cad534b121beb619a01",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/application.properties",
"request_line": "GET \/api\/application.properties HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/68.0.3440.84 Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKi",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/application.properties",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/application.properties",
"request_line": "GET \/api\/application.properties HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/68.0.3440.84 Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/application.properties",
"evidence_snippet": "GET \/api\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKi",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api",
"http_probe_api",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · HTTP
Sonde fichier credential / clé
credential file probe · via HTTP:9900 · (tentative d'exploit) · → /api/credentials.json
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /api/credentials.json UA Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950600:k8s-api
Cible HTTP
GET
/api/credentials.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/api/credentials.json
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « rce-0 » · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
pat-0472
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Credentials JSON
Ligne de requête
GET /api/credentials.json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36
Règles WAF
rce-0
nosqli-3
k8s-api
Payload (extrait)
GET /api/credentials.json HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.
Requête brute (extrait)
GET /api/credentials.json HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "a9475b154a06c5dd74981a5f86c430afe4ac9a57",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "bd2b2e522575cf2b6a79434a45baa745a109b7fe",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 254,
"payload_entropy": 5.411964088631819,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 100,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "19407382f3a179f2321e290946f7f231f7ab950f",
"event_fingerprint": "5f70a343eedcddd4221ea7a074fa6f178b63dd41",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 135,
"precision_signals": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0472"
],
"matched_pattern_names": [
"Cred Credentials JSON"
],
"pattern_ids": [
"pat-0472"
],
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "99cdf2ed738296e6d65f5b9900ae186b",
"payload_hash": "0112591c0eb40247983316b9fe461bc4",
"path_pattern_hash": "324ca375a9560f0f0442f12c08f92527"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/api\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit\/537.",
"method": "GET",
"path": "\/api\/credentials.json",
"user_agent": "Mozilla\/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"k8s-api"
],
"request_line": "GET \/api\/credentials.json HTTP\/1.1",
"request_sample": "GET \/api\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/api\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/api\/credentials.json",
"user_agent": "Mozilla\/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"k8s-api"
],
"request_line": "GET \/api\/credentials.json HTTP\/1.1",
"request_sample": "GET \/api\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/api\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit\/537.",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4bcac6601df7fde94a7c2753959e954cb32a0e43",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/credentials.json",
"request_line": "GET \/api\/credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit\/537.",
"attack_vector": "credential file probe \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/credentials.json",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"pat-0472",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/credentials.json",
"request_line": "GET \/api\/credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/credentials.json",
"evidence_snippet": "GET \/api\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit\/537.",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api",
"http_probe_api",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /settings.php
Élevée
Moyen · 54
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /settings.php UA Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, …
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
http_probe_settings
net_flood
Cible HTTP
GET
/settings.php
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/settings.php
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Settings PHP
Ligne de requête
GET /settings.php HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /settings.php HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, li
Requête brute (extrait)
GET /settings.php HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "php",
"http_ua_hash": "e22413a37828b41c92d8c8208bfb4111d21d971b",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "82d3610aa3e19f51e6faea30fd476c3facb744f8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 241,
"payload_entropy": 5.415421235341412,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 60,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 54,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4d7554ca26a12f9bde61db9cfc4797d2af6869a5",
"event_fingerprint": "e17696304ba18a5118d0bdf459b81a7af00b74d6",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0500"
],
"matched_pattern_names": [
"Cred Settings PHP"
],
"pattern_ids": [
"pat-0500"
],
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "45b62a6210b95d59888d064ec7eb8069",
"payload_hash": "26a590cc1528da8ee470652f004272dc",
"path_pattern_hash": "23157306e7088efe4ec83e736f6b3e07"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/settings.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, li",
"method": "GET",
"path": "\/settings.php",
"user_agent": "Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/45.0.2454.101 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/settings.php HTTP\/1.1",
"request_sample": "GET \/settings.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/45.0.2454.101 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/settings.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, li",
"evidence": {
"method": "GET",
"path": "\/settings.php",
"user_agent": "Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/45.0.2454.101 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/settings.php HTTP\/1.1",
"request_sample": "GET \/settings.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/45.0.2454.101 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/settings.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, li",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2246637f0cfe312b2cbd11bda74f8c5d11eceac4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/settings.php",
"request_line": "GET \/settings.php HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/45.0.2454.101 Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/settings.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, li",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/settings.php",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/settings.php",
"request_line": "GET \/settings.php HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/45.0.2454.101 Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/settings.php",
"evidence_snippet": "GET \/settings.php HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, li",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"http_probe_settings",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /settings.py
Élevée
Moyen · 54
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /settings.py UA Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, …
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
net_flood
Cible HTTP
GET
/settings.py
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/settings.py
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Django settings
Ligne de requête
GET /settings.py HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.76 Safari/537.36 OPR/28.0.1750.40
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /settings.py HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, lik
Requête brute (extrait)
GET /settings.py HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.76 Safari/537.36 OPR/28.0.1750.40 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "py",
"http_ua_hash": "a48e2906a94ec5677ce731233be684b23b9eb4b8",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "3d04c639f33f174cecedd8e2b5ee24fd5f889511",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 256,
"payload_entropy": 5.4568538946706235,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 60,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 54,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "46b38a66c1d5f50cf15dd70a9739194f116117c8",
"event_fingerprint": "034adee849dcaf008d357d836d1fab08c1ca9ecb",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0112"
],
"matched_pattern_names": [
"LFI Django settings"
],
"pattern_ids": [
"pat-0112"
],
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c75374200fddd57c03fa3f60251c11e5",
"payload_hash": "3cf727c648ed8eba8f460d94a267d337",
"path_pattern_hash": "11cbdc1d0934c26ecc216cf25354d01f"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2; WOW64) AppleWebKit\/537.36 (KHTML, lik",
"method": "GET",
"path": "\/settings.py",
"user_agent": "Mozilla\/5.0 (Windows NT 6.2; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/41.0.2272.76 Safari\/537.36 OPR\/28.0.1750.40",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/settings.py HTTP\/1.1",
"request_sample": "GET \/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/41.0.2272.76 Safari\/537.36 OPR\/28.0.1750.40\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2; WOW64) AppleWebKit\/537.36 (KHTML, lik",
"evidence": {
"method": "GET",
"path": "\/settings.py",
"user_agent": "Mozilla\/5.0 (Windows NT 6.2; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/41.0.2272.76 Safari\/537.36 OPR\/28.0.1750.40",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/settings.py HTTP\/1.1",
"request_sample": "GET \/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/41.0.2272.76 Safari\/537.36 OPR\/28.0.1750.40\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2; WOW64) AppleWebKit\/537.36 (KHTML, lik",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dd54fcc0757d1022285504a8f486583d054312fe",
"protocol_details": {
"http_method": "GET",
"http_path": "\/settings.py",
"request_line": "GET \/settings.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.2; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/41.0.2272.76 Safari\/537.36 OPR\/28.0.1\u2026",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2; WOW64) AppleWebKit\/537.36 (KHTML, lik",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/settings.py",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/settings.py",
"request_line": "GET \/settings.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.2; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/41.0.2272.76 Safari\/537.36 OPR\/28.0.1\u2026",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/settings.py",
"evidence_snippet": "GET \/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2; WOW64) AppleWebKit\/537.36 (KHTML, lik",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /src/application.properties
Élevée
Moyen · 62
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /src/application.properties UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0b6pre) Gecko…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/src/application.properties
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/src/application.properties
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 62
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /src/application.properties HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0b6pre) Gecko/20100907 Firefox/4.0b6pre Camino/2.2a1pre
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /src/application.properties HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0
Requête brute (extrait)
GET /src/application.properties HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0b6pre) Gecko/20100907 Firefox/4.0b6pre Camino/2.2a1pre Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "properties",
"http_ua_hash": "f47b9a59f83ff87c1c152341369541a64e22a21e",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "768d564965356c4daa1d64414a9bc4107eab2558",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 251,
"payload_entropy": 5.2595762877453875,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 62,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4e9ee6c02a5943d02ed1fdefbaf390ad3389e177",
"event_fingerprint": "e6a9c1f5689e234da7da738bce3069ac96fa0965",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f9311593796430f2654628d24dd80f1a",
"payload_hash": "530b90b77a0633a761e46fe9dc8dd73c",
"path_pattern_hash": "db2b25e0227df53a411ba0201f54fb0e"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 62
},
"payload_preview": "GET \/src\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0",
"method": "GET",
"path": "\/src\/application.properties",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0b6pre) Gecko\/20100907 Firefox\/4.0b6pre Camino\/2.2a1pre",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/src\/application.properties HTTP\/1.1",
"request_sample": "GET \/src\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0b6pre) Gecko\/20100907 Firefox\/4.0b6pre Camino\/2.2a1pre\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/src\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0",
"evidence": {
"method": "GET",
"path": "\/src\/application.properties",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0b6pre) Gecko\/20100907 Firefox\/4.0b6pre Camino\/2.2a1pre",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/src\/application.properties HTTP\/1.1",
"request_sample": "GET \/src\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0b6pre) Gecko\/20100907 Firefox\/4.0b6pre Camino\/2.2a1pre\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/src\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bd78c2d87acdc1e7eb72fc777858a55868f4fe91",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/application.properties",
"request_line": "GET \/src\/application.properties HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0b6pre) Gecko\/20100907 Firefox\/4.0b6pre Camino\/2.2a1pre",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/src\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/application.properties",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 62,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/application.properties",
"request_line": "GET \/src\/application.properties HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0b6pre) Gecko\/20100907 Firefox\/4.0b6pre Camino\/2.2a1pre",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/application.properties",
"evidence_snippet": "GET \/src\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /configuration.yml
Élevée
Moyen · 54
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /configuration.yml UA Mozilla/5.0 (SymbianOS/9.1; U; en-us) AppleWebKit/413 (KHTML, l…
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
net_flood
Cible HTTP
GET
/configuration.yml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/configuration.yml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /configuration.yml HTTP/1.1
User-Agent
Mozilla/5.0 (SymbianOS/9.1; U; en-us) AppleWebKit/413 (KHTML, like Gecko) Safari/413 es50
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /configuration.yml HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (SymbianOS/9.1; U; en-us) AppleWebKit/413 (KHTML
Requête brute (extrait)
GET /configuration.yml HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (SymbianOS/9.1; U; en-us) AppleWebKit/413 (KHTML, like Gecko) Safari/413 es50 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yml",
"http_ua_hash": "cb4b1b750e753434b1d9a07b45ceeb9485f74750",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "f5ba477be733eb286d73c795898898c4df753007",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 226,
"payload_entropy": 5.390032462226995,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 60,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 54,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "46b38a66c1d5f50cf15dd70a9739194f116117c8",
"event_fingerprint": "4c00ac68250fe7546a89785be0deb589a773139f",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6ada5f944d3e9ea5ff2aae41c3b4d633",
"payload_hash": "4303a545b5b276c8113645eb13b5ae40",
"path_pattern_hash": "11d7130e53c98b3dd086ae8969367205"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/configuration.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (SymbianOS\/9.1; U; en-us) AppleWebKit\/413 (KHTML",
"method": "GET",
"path": "\/configuration.yml",
"user_agent": "Mozilla\/5.0 (SymbianOS\/9.1; U; en-us) AppleWebKit\/413 (KHTML, like Gecko) Safari\/413 es50",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/configuration.yml HTTP\/1.1",
"request_sample": "GET \/configuration.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (SymbianOS\/9.1; U; en-us) AppleWebKit\/413 (KHTML, like Gecko) Safari\/413 es50\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/configuration.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (SymbianOS\/9.1; U; en-us) AppleWebKit\/413 (KHTML",
"evidence": {
"method": "GET",
"path": "\/configuration.yml",
"user_agent": "Mozilla\/5.0 (SymbianOS\/9.1; U; en-us) AppleWebKit\/413 (KHTML, like Gecko) Safari\/413 es50",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/configuration.yml HTTP\/1.1",
"request_sample": "GET \/configuration.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (SymbianOS\/9.1; U; en-us) AppleWebKit\/413 (KHTML, like Gecko) Safari\/413 es50\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/configuration.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (SymbianOS\/9.1; U; en-us) AppleWebKit\/413 (KHTML",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e554745d9c4e21f9f267c0c30b2228eeadd62f23",
"protocol_details": {
"http_method": "GET",
"http_path": "\/configuration.yml",
"request_line": "GET \/configuration.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (SymbianOS\/9.1; U; en-us) AppleWebKit\/413 (KHTML, like Gecko) Safari\/413 es50",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/configuration.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (SymbianOS\/9.1; U; en-us) AppleWebKit\/413 (KHTML",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/configuration.yml",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/configuration.yml",
"request_line": "GET \/configuration.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (SymbianOS\/9.1; U; en-us) AppleWebKit\/413 (KHTML, like Gecko) Safari\/413 es50",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/configuration.yml",
"evidence_snippet": "GET \/configuration.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (SymbianOS\/9.1; U; en-us) AppleWebKit\/413 (KHTML",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9900 · (tentative d'exploit) · → /server/config.json
Élevée
Moyen · 61
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /server/config.json UA Mozilla/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us)…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_sensitive_path
Cible HTTP
GET
/server/config.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/server/config.json
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /server/config.json HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us) AppleWebKit/525.18.1 (KHTML, like Gecko) Version/3.1.1 Mobile/5A347 Safari/525.200
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /server/config.json HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en
Requête brute (extrait)
GET /server/config.json HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us) AppleWebKit/525.18.1 (KHTML, like Gecko) Version/3.1.1 Mobile/5A347 Safari/525.200 Accept-Charset: utf-8 Accept-Encoding:
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "6d10ed516e2c23ca8f7bde0be44e14eb0b92730a",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "6256573df3840cfac04bc2ab872867391edaaec3",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 284,
"payload_entropy": 5.382864270621136,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 84,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 84,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 61,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "83af4764d90614a94c4b444ef57f93a2112b44e0",
"event_fingerprint": "5400d0e4da00c0072ebf09d114880759768ae3c9",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7523c5d32d67d6334420581b77fccf10",
"payload_hash": "a0532a32540660787f32d285a00589d1",
"path_pattern_hash": "d098cd03de959936fc86eaeec4921ada"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "GET \/server\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en",
"method": "GET",
"path": "\/server\/config.json",
"user_agent": "Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us) AppleWebKit\/525.18.1 (KHTML, like Gecko) Version\/3.1.1 Mobile\/5A347 Safari\/525.200",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/server\/config.json HTTP\/1.1",
"request_sample": "GET \/server\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us) AppleWebKit\/525.18.1 (KHTML, like Gecko) Version\/3.1.1 Mobile\/5A347 Safari\/525.200\r\nAccept-Charset: utf-8\r\nAccept-Encoding:",
"payload_snippet": "GET \/server\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en",
"evidence": {
"method": "GET",
"path": "\/server\/config.json",
"user_agent": "Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us) AppleWebKit\/525.18.1 (KHTML, like Gecko) Version\/3.1.1 Mobile\/5A347 Safari\/525.200",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/server\/config.json HTTP\/1.1",
"request_sample": "GET \/server\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us) AppleWebKit\/525.18.1 (KHTML, like Gecko) Version\/3.1.1 Mobile\/5A347 Safari\/525.200\r\nAccept-Charset: utf-8\r\nAccept-Encoding:",
"payload_snippet": "GET \/server\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9959b0d898f125399997f1a4a3bb1c5dce71dc6e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server\/config.json",
"request_line": "GET \/server\/config.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us) AppleWebKit\/525.18.1 (KHTML, like Gecko) Version\/3.1.1 \u2026",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/server\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en",
"attack_vector": "config file probe \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server\/config.json",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server\/config.json",
"request_line": "GET \/server\/config.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us) AppleWebKit\/525.18.1 (KHTML, like Gecko) Version\/3.1.1 \u2026",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server\/config.json",
"evidence_snippet": "GET \/server\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /server/database.yml
Élevée
Moyen · 62
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /server/database.yml UA Mozilla/5.0 (Linux; Android 9; RMX1801) AppleWebKit/537.36 (KHT…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/server/database.yml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/server/database.yml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 62
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Database YAML
Ligne de requête
GET /server/database.yml HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; RMX1801) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /server/database.yml HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (Linux; Android 9; RMX1801) AppleWebKit/537.36
Requête brute (extrait)
GET /server/database.yml HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (Linux; Android 9; RMX1801) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "yml",
"http_ua_hash": "cd081cf32c7af044352f8b2856a18f1824db007f",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "aa0f50eb579ffeade54de0b8a91905c499016135",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 259,
"payload_entropy": 5.445146834607659,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 62,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "c6ad78344e4512a024145270f3146847afcc6257",
"event_fingerprint": "9b0fb9100ce6176eba207a823031bb6e277b51ef",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0474"
],
"matched_pattern_names": [
"Cred Database YAML"
],
"pattern_ids": [
"pat-0474"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "233ef1c039aaa5ebdc8ce5615d566cc2",
"payload_hash": "25a8393d1f06fc49b2b8ed12b403f091",
"path_pattern_hash": "71d6b5c79d1b79d1d13caa0c134a8b3a"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 62
},
"payload_preview": "GET \/server\/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; RMX1801) AppleWebKit\/537.36",
"method": "GET",
"path": "\/server\/database.yml",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; RMX1801) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/server\/database.yml HTTP\/1.1",
"request_sample": "GET \/server\/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; RMX1801) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r",
"payload_snippet": "GET \/server\/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; RMX1801) AppleWebKit\/537.36",
"evidence": {
"method": "GET",
"path": "\/server\/database.yml",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; RMX1801) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/server\/database.yml HTTP\/1.1",
"request_sample": "GET \/server\/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; RMX1801) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r",
"payload_snippet": "GET \/server\/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; RMX1801) AppleWebKit\/537.36",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4cae9135fa82fe9b979d0151c994b6c8c449ddf2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server\/database.yml",
"request_line": "GET \/server\/database.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; RMX1801) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/server\/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; RMX1801) AppleWebKit\/537.36",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server\/database.yml",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 62,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server\/database.yml",
"request_line": "GET \/server\/database.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; RMX1801) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server\/database.yml",
"evidence_snippet": "GET \/server\/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; RMX1801) AppleWebKit\/537.36",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · TLS
Sonde PostgreSQL
postgres probe · via TLS:9900 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
9900
Chemin / cible
—
Service
TLS
Payload
� �3k���md| �`��>�M��è���B"nX��.� ��2e��8��Z{�-�' >,F)Y�̨̨���9 &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �3k���md| �`��>�M����B"nX��.� ��2e��8��Z{�-�'
>,F)Y�̨̨���9 &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� �3k���md| �`��>�M��è���B"nX��.� ��2e��8��Z{�-�' >,F)Y�̨̨���9 &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ ��. uP��dBJ7���N�4WM�Mw�C�S
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.77636960272152,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9bc6e9422076201846bf3268f1c965cbd91f8034",
"event_fingerprint": "494c9f1d51d87e4e628444cc1ac6318d28c9083c",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "35313c8a6e4d79b34e0bee700648d5a4",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9900,
"service": "tls",
"service_name": "tls",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00033k\ufffd\ufffd\ufffdmd| \u000b\ufffd`\ufffd\ufffd>\ufffdM\ufffd\ufffd\u00e8\ufffd\ufffd\ufffdB\"nX\ufffd\ufffd.\ufffd \ufffd\ufffd\u00102e\ufffd\ufffd8\ufffd\ufffdZ{\ufffd-\u0010\ufffd'\n>,F)Y\ufffd\u0328\u0328\ufffd\ufffd\ufffd9\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00033k\ufffd\ufffd\ufffdmd| \u000b\ufffd`\ufffd\ufffd>\ufffdM\ufffd\ufffd\u00e8\ufffd\ufffd\ufffdB\"nX\ufffd\ufffd.\ufffd \ufffd\ufffd\u00102e\ufffd\ufffd8\ufffd\ufffdZ{\ufffd-\u0010\ufffd'\n>,F)Y\ufffd\u0328\u0328\ufffd\ufffd\ufffd9\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u0003\ufffd.\u000bu\u0001P\ufffd\ufffddBJ7\ufffd\ufffd\ufffdN\ufffd\u00184WM\ufffdMw\u001a\ufffdC\ufffdS",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00033k\ufffd\ufffd\ufffdmd| \u000b\ufffd`\ufffd\ufffd>\ufffdM\ufffd\ufffd\u00e8\ufffd\ufffd\ufffdB\"nX\ufffd\ufffd.\ufffd \ufffd\ufffd\u00102e\ufffd\ufffd8\ufffd\ufffdZ{\ufffd-\u0010\ufffd'\n>,F)Y\ufffd\u0328\u0328\ufffd\ufffd\ufffd9\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "020acba244de88c420d53ee733136bbd2f36a386",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00033k\ufffd\ufffd\ufffdmd| \u000b\ufffd`\ufffd\ufffd>\ufffdM\ufffd\ufffd\u00e8\ufffd\ufffd\ufffdB\"nX\ufffd\ufffd.\ufffd \ufffd\ufffd\u00102e\ufffd\ufffd8\ufffd\ufffdZ{\ufffd-\u0010\ufffd'\n>,F)Y\ufffd\u0328\u0328\ufffd\ufffd\ufffd9\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9900,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd3k\ufffd\ufffd\ufffdmd| \ufffd`\ufffd\ufffd>\ufffdM\ufffd\ufffd\u00e8\ufffd\ufffd\ufffdB\"nX\ufffd\ufffd.\ufffd \ufffd\ufffd2e\ufffd\ufffd8\ufffd\ufffdZ{\ufffd-\ufffd'\n>,F)Y\ufffd\u0328\u0328\ufffd\ufffd\ufffd9&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via TLS:9900 \u00b7 (sonde \/ probe)",
"target_port_label": "9900 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00033k\ufffd\ufffd\ufffdmd| \u000b\ufffd`\ufffd\ufffd>\ufffdM\ufffd\ufffd\u00e8\ufffd\ufffd\ufffdB\"nX\ufffd\ufffd.\ufffd \ufffd\ufffd\u00102e\ufffd\ufffd8\ufffd\ufffdZ{\ufffd-\u0010\ufffd'\n>,F)Y\ufffd\u0328\u0328\ufffd\ufffd\ufffd9\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9900,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:9900 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd3k\ufffd\ufffd\ufffdmd| \ufffd`\ufffd\ufffd>\ufffdM\ufffd\ufffd\u00e8\ufffd\ufffd\ufffdB\"nX\ufffd\ufffd.\ufffd \ufffd\ufffd2e\ufffd\ufffd8\ufffd\ufffdZ{\ufffd-\ufffd'\n>,F)Y\ufffd\u0328\u0328\ufffd\ufffd\ufffd9&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "9900 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /settings.ini
Élevée
Moyen · 54
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /settings.ini UA Mozilla/5.0 (Linux; Android 8.0.0; SAMSUNG-SM-G891A) AppleWebKi…
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
net_flood
Cible HTTP
GET
/settings.ini
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/settings.ini
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /settings.ini HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 8.0.0; SAMSUNG-SM-G891A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /settings.ini HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SAMSUNG-SM-G891A) AppleWebKit/
Requête brute (extrait)
GET /settings.ini HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SAMSUNG-SM-G891A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection:
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ini",
"http_ua_hash": "8618dc14169fc05291de9196b9523adeaac2bf22",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "f01ec89928fe2f3ee90d02a7d289d5d5096b75ef",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 265,
"payload_entropy": 5.407990174830962,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 60,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 54,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cf8b5ea650e32f276b9aa8e6f5e55e9245ae18aa",
"event_fingerprint": "de27f104d78d619f026019cb8bfb525679624e8d",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6c59b18c92039dcfd4ea9772ac5429fc",
"payload_hash": "80543bb5f36497340cfd450f6e63a2dd",
"path_pattern_hash": "9c5f76c4cd2a45bfda2541100b559957"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/settings.ini HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG-SM-G891A) AppleWebKit\/",
"method": "GET",
"path": "\/settings.ini",
"user_agent": "Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG-SM-G891A) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/settings.ini HTTP\/1.1",
"request_sample": "GET \/settings.ini HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG-SM-G891A) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: ",
"payload_snippet": "GET \/settings.ini HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG-SM-G891A) AppleWebKit\/",
"evidence": {
"method": "GET",
"path": "\/settings.ini",
"user_agent": "Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG-SM-G891A) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/settings.ini HTTP\/1.1",
"request_sample": "GET \/settings.ini HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG-SM-G891A) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: ",
"payload_snippet": "GET \/settings.ini HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG-SM-G891A) AppleWebKit\/",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bf7e6dba11590be88d815ef39f5173e19be77793",
"protocol_details": {
"http_method": "GET",
"http_path": "\/settings.ini",
"request_line": "GET \/settings.ini HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG-SM-G891A) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile\u2026",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/settings.ini HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG-SM-G891A) AppleWebKit\/",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/settings.ini",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/settings.ini",
"request_line": "GET \/settings.ini HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG-SM-G891A) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile\u2026",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/settings.ini",
"evidence_snippet": "GET \/settings.ini HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG-SM-G891A) AppleWebKit\/",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · TLS
Sonde PostgreSQL
postgres probe · via TLS:9900 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
9900
Chemin / cible
—
Service
TLS
Payload
� �A0�n� ����9�� .���� ��� �2R���������)�(��wݞ������p2�E &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �A0�n� ����9�� .����
��� �2R���������)�(��wݞ������p2�E &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� �A0�n� ����9�� .���� ��� �2R���������)�(��wݞ������p2�E &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ ��5���_p��l~R��j��j�F� ��H�_|
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.860262003468664,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9bc6e9422076201846bf3268f1c965cbd91f8034",
"event_fingerprint": "494c9f1d51d87e4e628444cc1ac6318d28c9083c",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "e4e6ef7edaa3ca18e01648252203de1d",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9900,
"service": "tls",
"service_name": "tls",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003A\u00100\ufffdn\ufffd\t\ufffd\ufffd\ufffd\u0015\ufffd9\ufffd\ufffd\u001f.\ufffd\ufffd\u07bf\u001b\ufffd\ufffd\r\ufffd\ufffd\ufffd \ufffd2R\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0002\ufffd\ufffd\ufffd)\ufffd(\ufffd\u0001\ufffdw\u075e\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdp2\ufffdE\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003A\u00100\ufffdn\ufffd\t\ufffd\ufffd\ufffd\u0015\ufffd9\ufffd\ufffd\u001f.\ufffd\ufffd\u07bf\u001b\ufffd\ufffd\r\ufffd\ufffd\ufffd \ufffd2R\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0002\ufffd\ufffd\ufffd)\ufffd(\ufffd\u0001\ufffdw\u075e\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdp2\ufffdE\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd5\u0014\ufffd\ufffd\ufffd_p\ufffd\ufffdl~R\ufffd\ufffdj\ufffd\u001b\ufffdj\ufffdF\ufffd\u001d\ufffd\ufffdH\ufffd_|\u0010",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003A\u00100\ufffdn\ufffd\t\ufffd\ufffd\ufffd\u0015\ufffd9\ufffd\ufffd\u001f.\ufffd\ufffd\u07bf\u001b\ufffd\ufffd\r\ufffd\ufffd\ufffd \ufffd2R\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0002\ufffd\ufffd\ufffd)\ufffd(\ufffd\u0001\ufffdw\u075e\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdp2\ufffdE\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ad1747e616c3fc18ac289edbf0f7b16fed7d3d57",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003A\u00100\ufffdn\ufffd\t\ufffd\ufffd\ufffd\u0015\ufffd9\ufffd\ufffd\u001f.\ufffd\ufffd\u07bf\u001b\ufffd\ufffd\r\ufffd\ufffd\ufffd \ufffd2R\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0002\ufffd\ufffd\ufffd)\ufffd(\ufffd\u0001\ufffdw\u075e\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdp2\ufffdE\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9900,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdA0\ufffdn\ufffd\t\ufffd\ufffd\ufffd\ufffd9\ufffd\ufffd.\ufffd\ufffd\u07bf\ufffd\ufffd\r\ufffd\ufffd\ufffd \ufffd2R\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd)\ufffd(\ufffd\ufffdw\u075e\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdp2\ufffdE&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via TLS:9900 \u00b7 (sonde \/ probe)",
"target_port_label": "9900 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003A\u00100\ufffdn\ufffd\t\ufffd\ufffd\ufffd\u0015\ufffd9\ufffd\ufffd\u001f.\ufffd\ufffd\u07bf\u001b\ufffd\ufffd\r\ufffd\ufffd\ufffd \ufffd2R\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0002\ufffd\ufffd\ufffd)\ufffd(\ufffd\u0001\ufffdw\u075e\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdp2\ufffdE\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9900,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:9900 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdA0\ufffdn\ufffd\t\ufffd\ufffd\ufffd\ufffd9\ufffd\ufffd.\ufffd\ufffd\u07bf\ufffd\ufffd\r\ufffd\ufffd\ufffd \ufffd2R\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd)\ufffd(\ufffd\ufffdw\u075e\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdp2\ufffdE&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "9900 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /server/application.yml
Élevée
Moyen · 62
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /server/application.yml UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/125.2 …
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/server/application.yml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/server/application.yml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 62
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /server/application.yml HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/125.2 (KHTML, like Gecko) Safari/125.8
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /server/application.yml HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKi
Requête brute (extrait)
GET /server/application.yml HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/125.2 (KHTML, like Gecko) Safari/125.8 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "yml",
"http_ua_hash": "96a123e9e5f679a86d90c16ef2be258a487982f4",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "1babc6c454a6fc42efeb454c80481032b2fa8f90",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 237,
"payload_entropy": 5.361997342944821,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 62,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "c6ad78344e4512a024145270f3146847afcc6257",
"event_fingerprint": "cf1699a88373d2a7086243915f3bd8ad7c612551",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1c75e1f34e9482833bae95e14edc82ee",
"payload_hash": "d4c80f98f894be8b9ca2af8faf7a5a67",
"path_pattern_hash": "23f526d2ca37db6a43ced5d6a1fca46f"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 62
},
"payload_preview": "GET \/server\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKi",
"method": "GET",
"path": "\/server\/application.yml",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit\/125.2 (KHTML, like Gecko) Safari\/125.8",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/server\/application.yml HTTP\/1.1",
"request_sample": "GET \/server\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit\/125.2 (KHTML, like Gecko) Safari\/125.8\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/server\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKi",
"evidence": {
"method": "GET",
"path": "\/server\/application.yml",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit\/125.2 (KHTML, like Gecko) Safari\/125.8",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/server\/application.yml HTTP\/1.1",
"request_sample": "GET \/server\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit\/125.2 (KHTML, like Gecko) Safari\/125.8\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/server\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKi",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "af75ba8654bb6e4aac42ef69c44db068aaee9917",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server\/application.yml",
"request_line": "GET \/server\/application.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit\/125.2 (KHTML, like Gecko) Safari\/125.8",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/server\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKi",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server\/application.yml",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 62,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server\/application.yml",
"request_line": "GET \/server\/application.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit\/125.2 (KHTML, like Gecko) Safari\/125.8",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server\/application.yml",
"evidence_snippet": "GET \/server\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKi",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · HTTP
Sonde fichier credential / clé
credential file probe · via HTTP:9900 · (tentative d'exploit) · → /server/credentials.json
Élevée
Moyen · 62
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /server/credentials.json UA Mozilla/5.0 (Linux; Android 7.0; i1) AppleWebKit/537.36 (KHTML,…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/server/credentials.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/server/credentials.json
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « rce-0 » · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 62
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0472
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Credentials JSON
Ligne de requête
GET /server/credentials.json HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 7.0; i1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /server/credentials.json HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (Linux; Android 7.0; i1) AppleWebKit/537.3
Requête brute (extrait)
GET /server/credentials.json HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (Linux; Android 7.0; i1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "5b49ea3cf9b7ab04bc9d808c974492cdeab7a564",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "0448476e8596bfb535234584ac471c02983c6fe7",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 260,
"payload_entropy": 5.381325769489626,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 84,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 62,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "0d0bfb287b52cdf9327bc7d7d9f0c3315c6a6096",
"event_fingerprint": "17f8fab180a23202138fc4a420442242f64cdb4c",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 135,
"precision_signals": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0472"
],
"matched_pattern_names": [
"Cred Credentials JSON"
],
"pattern_ids": [
"pat-0472"
],
"confidence_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "af2ac7c17087d544fe503a78635aa473",
"payload_hash": "c7cfc2439201c67a9ca4941901f0b183",
"path_pattern_hash": "017fc0dcd972a4e3aefd53875717b41b"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 62
},
"payload_preview": "GET \/server\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; i1) AppleWebKit\/537.3",
"method": "GET",
"path": "\/server\/credentials.json",
"user_agent": "Mozilla\/5.0 (Linux; Android 7.0; i1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/server\/credentials.json HTTP\/1.1",
"request_sample": "GET \/server\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; i1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close",
"payload_snippet": "GET \/server\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; i1) AppleWebKit\/537.3",
"evidence": {
"method": "GET",
"path": "\/server\/credentials.json",
"user_agent": "Mozilla\/5.0 (Linux; Android 7.0; i1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/server\/credentials.json HTTP\/1.1",
"request_sample": "GET \/server\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; i1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close",
"payload_snippet": "GET \/server\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; i1) AppleWebKit\/537.3",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c7ac74fc6acd53750ae2575a42a01fd9e62a206c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server\/credentials.json",
"request_line": "GET \/server\/credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 7.0; i1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Mobile Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/server\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; i1) AppleWebKit\/537.3",
"attack_vector": "credential file probe \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server\/credentials.json",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 62,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"pat-0472",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server\/credentials.json",
"request_line": "GET \/server\/credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 7.0; i1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Mobile Safari\/537.36",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server\/credentials.json",
"evidence_snippet": "GET \/server\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; i1) AppleWebKit\/537.3",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · TLS
Sonde PostgreSQL
postgres probe · via TLS:9900 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
9900
Chemin / cible
—
Service
TLS
Payload
� �(�����B, �:�L�����~"u t�9:� �*�h�T}�� �y�T� ��\Rw��Gd\�m &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �(�����B,
�:�L�����~"u
t�9:� �*�h�T}��
�y�T� ��\Rw��Gd\�m &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� �(�����B, �:�L�����~"u t�9:� �*�h�T}�� �y�T� ��\Rw��Gd\�m &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ �|A]�@�f�����H ���K�9�,O�@�B0
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.8654002497298805,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9bc6e9422076201846bf3268f1c965cbd91f8034",
"event_fingerprint": "494c9f1d51d87e4e628444cc1ac6318d28c9083c",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "198913cf3f0829e9a5ec0c1bdab07ab9",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9900,
"service": "tls",
"service_name": "tls",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003(\ufffd\ufffd\ufffd\ufffd\ufffdB,\n\ufffd:\ufffdL\ufffd\ufffd\ufffd\u0002\ufffd\u0015\ufffd~\"u\nt\ufffd9\u000e:\u0018\ufffd\u001f \ufffd*\ufffdh\ufffdT}\ufffd\ufffd\n\u0005\ufffdy\ufffdT\ufffd\u001c\u001a\ufffd\ufffd\\Rw\ufffd\ufffdGd\\\ufffdm\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003(\ufffd\ufffd\ufffd\ufffd\ufffdB,\n\ufffd:\ufffdL\ufffd\ufffd\ufffd\u0002\ufffd\u0015\ufffd~\"u\nt\ufffd9\u000e:\u0018\ufffd\u001f \ufffd*\ufffdh\ufffdT}\ufffd\ufffd\n\u0005\ufffdy\ufffdT\ufffd\u001c\u001a\ufffd\ufffd\\Rw\ufffd\ufffdGd\\\ufffdm\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd|A]\ufffd@\ufffdf\ufffd\ufffd\u0010\u0014\ufffd\ufffd\ufffdH\u001c\ufffd\ufffd\ufffdK\ufffd9\ufffd,O\ufffd@\ufffdB0",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003(\ufffd\ufffd\ufffd\ufffd\ufffdB,\n\ufffd:\ufffdL\ufffd\ufffd\ufffd\u0002\ufffd\u0015\ufffd~\"u\nt\ufffd9\u000e:\u0018\ufffd\u001f \ufffd*\ufffdh\ufffdT}\ufffd\ufffd\n\u0005\ufffdy\ufffdT\ufffd\u001c\u001a\ufffd\ufffd\\Rw\ufffd\ufffdGd\\\ufffdm\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c407f82b11d055c18fdaa764d80bc85c35b2e702",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003(\ufffd\ufffd\ufffd\ufffd\ufffdB,\n\ufffd:\ufffdL\ufffd\ufffd\ufffd\u0002\ufffd\u0015\ufffd~\"u\nt\ufffd9\u000e:\u0018\ufffd\u001f \ufffd*\ufffdh\ufffdT}\ufffd\ufffd\n\u0005\ufffdy\ufffdT\ufffd\u001c\u001a\ufffd\ufffd\\Rw\ufffd\ufffdGd\\\ufffdm\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9900,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffdB,\n\ufffd:\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd~\"u\nt\ufffd9:\ufffd \ufffd*\ufffdh\ufffdT}\ufffd\ufffd\n\ufffdy\ufffdT\ufffd\ufffd\ufffd\\Rw\ufffd\ufffdGd\\\ufffdm&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via TLS:9900 \u00b7 (sonde \/ probe)",
"target_port_label": "9900 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003(\ufffd\ufffd\ufffd\ufffd\ufffdB,\n\ufffd:\ufffdL\ufffd\ufffd\ufffd\u0002\ufffd\u0015\ufffd~\"u\nt\ufffd9\u000e:\u0018\ufffd\u001f \ufffd*\ufffdh\ufffdT}\ufffd\ufffd\n\u0005\ufffdy\ufffdT\ufffd\u001c\u001a\ufffd\ufffd\\Rw\ufffd\ufffdGd\\\ufffdm\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9900,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:9900 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffdB,\n\ufffd:\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd~\"u\nt\ufffd9:\ufffd \ufffd*\ufffdh\ufffdT}\ufffd\ufffd\n\ufffdy\ufffdT\ufffd\ufffd\ufffd\\Rw\ufffd\ufffdGd\\\ufffdm&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "9900 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · TLS
Sonde PostgreSQL
postgres probe · via TLS:9900 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
9900
Chemin / cible
—
Service
TLS
Payload
� �_�� K��hL�� �_���Ϟ��{���,���g iX�~���T�#�ݛ0步�P�=R��3�͈F &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �_��
K��hL�� �_���Ϟ��{���,���g iX�~���T�#�ݛ0步�P�=R��3�͈F &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� �_�� K��hL�� �_���Ϟ��{���,���g iX�~���T�#�ݛ0步�P�=R��3�͈F &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ n�v�]�;6�Y�2��V�d�C_ I �S��l�v6
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.85486641597628,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9bc6e9422076201846bf3268f1c965cbd91f8034",
"event_fingerprint": "494c9f1d51d87e4e628444cc1ac6318d28c9083c",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "3fd82236a5b8a20c79993778f2f7c878",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9900,
"service": "tls",
"service_name": "tls",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003_\ufffd\ufffd\nK\ufffd\ufffdhL\ufffd\ufffd\u001c\ufffd\u0003_\ufffd\ufffd\ufffd\u03de\ufffd\ufffd{\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffdg iX\ufffd~\ufffd\ufffd\ufffdT\ufffd#\ufffd\u075b0\u6b65\ufffdP\ufffd=R\ufffd\ufffd3\ufffd\u0348\u0019F\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003_\ufffd\ufffd\nK\ufffd\ufffdhL\ufffd\ufffd\u001c\ufffd\u0003_\ufffd\ufffd\ufffd\u03de\ufffd\ufffd{\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffdg iX\ufffd~\ufffd\ufffd\ufffdT\ufffd#\ufffd\u075b0\u6b65\ufffdP\ufffd=R\ufffd\ufffd3\ufffd\u0348\u0019F\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 n\ufffdv\ufffd]\ufffd;6\ufffdY\ufffd2\ufffd\ufffd\u000eV\ufffdd\ufffdC_\nI\u000b\ufffdS\ufffd\ufffdl\ufffdv6",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003_\ufffd\ufffd\nK\ufffd\ufffdhL\ufffd\ufffd\u001c\ufffd\u0003_\ufffd\ufffd\ufffd\u03de\ufffd\ufffd{\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffdg iX\ufffd~\ufffd\ufffd\ufffdT\ufffd#\ufffd\u075b0\u6b65\ufffdP\ufffd=R\ufffd\ufffd3\ufffd\u0348\u0019F\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8b3085ca77eef7b221f93daad761aeeb170cb953",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003_\ufffd\ufffd\nK\ufffd\ufffdhL\ufffd\ufffd\u001c\ufffd\u0003_\ufffd\ufffd\ufffd\u03de\ufffd\ufffd{\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffdg iX\ufffd~\ufffd\ufffd\ufffdT\ufffd#\ufffd\u075b0\u6b65\ufffdP\ufffd=R\ufffd\ufffd3\ufffd\u0348\u0019F\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9900,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd_\ufffd\ufffd\nK\ufffd\ufffdhL\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffd\u03de\ufffd\ufffd{\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffdg iX\ufffd~\ufffd\ufffd\ufffdT\ufffd#\ufffd\u075b0\u6b65\ufffdP\ufffd=R\ufffd\ufffd3\ufffd\u0348F&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via TLS:9900 \u00b7 (sonde \/ probe)",
"target_port_label": "9900 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003_\ufffd\ufffd\nK\ufffd\ufffdhL\ufffd\ufffd\u001c\ufffd\u0003_\ufffd\ufffd\ufffd\u03de\ufffd\ufffd{\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffdg iX\ufffd~\ufffd\ufffd\ufffdT\ufffd#\ufffd\u075b0\u6b65\ufffdP\ufffd=R\ufffd\ufffd3\ufffd\u0348\u0019F\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9900,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:9900 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd_\ufffd\ufffd\nK\ufffd\ufffdhL\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffd\u03de\ufffd\ufffd{\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffdg iX\ufffd~\ufffd\ufffd\ufffdT\ufffd#\ufffd\u075b0\u6b65\ufffdP\ufffd=R\ufffd\ufffd3\ufffd\u0348F&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "9900 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · HTTP
Flood / DDoS
http flood · via HTTP:9900 · (tentative d'exploit) · → /app/application.yml
Élevée
Moyen · 62
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /app/application.yml UA Mozilla/5.0 (X11; U; FreeBSD i386; de-CH; rv:1.9.2.8) Gecko/201…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/app/application.yml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/app/application.yml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 62
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /app/application.yml HTTP/1.1
User-Agent
Mozilla/5.0 (X11; U; FreeBSD i386; de-CH; rv:1.9.2.8) Gecko/20100729 Firefox/3.6.8
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /app/application.yml HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; de-CH; rv:1.9.2.8) Geck
Requête brute (extrait)
GET /app/application.yml HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; de-CH; rv:1.9.2.8) Gecko/20100729 Firefox/3.6.8 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "yml",
"http_ua_hash": "9c98d81a5f71e58389fd2d6cbf990d6f81454f32",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "b81cb99a957232977d1980a7f865cbc683e36d9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 221,
"payload_entropy": 5.3614713788756285,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 62,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "c6ad78344e4512a024145270f3146847afcc6257",
"event_fingerprint": "953ce889c2af80bda6c9fdb30d394d874f6b0ea7",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "d4ed0ec0a17623dd0211aa99035b55cf",
"payload_hash": "5f0f8e3117c009753a4c83b8ebecd7d1",
"path_pattern_hash": "e505f8db721eb16de5bb99f765ce1e5a"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 62
},
"payload_preview": "GET \/app\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; U; FreeBSD i386; de-CH; rv:1.9.2.8) Geck",
"method": "GET",
"path": "\/app\/application.yml",
"user_agent": "Mozilla\/5.0 (X11; U; FreeBSD i386; de-CH; rv:1.9.2.8) Gecko\/20100729 Firefox\/3.6.8",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/app\/application.yml HTTP\/1.1",
"request_sample": "GET \/app\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; U; FreeBSD i386; de-CH; rv:1.9.2.8) Gecko\/20100729 Firefox\/3.6.8\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/app\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; U; FreeBSD i386; de-CH; rv:1.9.2.8) Geck",
"evidence": {
"method": "GET",
"path": "\/app\/application.yml",
"user_agent": "Mozilla\/5.0 (X11; U; FreeBSD i386; de-CH; rv:1.9.2.8) Gecko\/20100729 Firefox\/3.6.8",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/app\/application.yml HTTP\/1.1",
"request_sample": "GET \/app\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; U; FreeBSD i386; de-CH; rv:1.9.2.8) Gecko\/20100729 Firefox\/3.6.8\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/app\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; U; FreeBSD i386; de-CH; rv:1.9.2.8) Geck",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "803e6fde9aace5320cd0b23c23274ea5a25f1f34",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/application.yml",
"request_line": "GET \/app\/application.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; U; FreeBSD i386; de-CH; rv:1.9.2.8) Gecko\/20100729 Firefox\/3.6.8",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/app\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; U; FreeBSD i386; de-CH; rv:1.9.2.8) Geck",
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/application.yml",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 62,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/application.yml",
"request_line": "GET \/app\/application.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; U; FreeBSD i386; de-CH; rv:1.9.2.8) Gecko\/20100729 Firefox\/3.6.8",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/application.yml",
"evidence_snippet": "GET \/app\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (X11; U; FreeBSD i386; de-CH; rv:1.9.2.8) Geck",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:49:55 UTC
TCP
9900 · HTTP
Sonde fichier credential / clé
credential file probe · via HTTP:9900 · (tentative d'exploit) · → /app/secrets.json
Élevée
Moyen · 63
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /app/secrets.json UA Mozilla/5.0 (Linux; Android 8.0.0; SAMSUNG SM-N935F Build/R16NW…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_k8s_probe
Cible HTTP
GET
/app/secrets.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9900
Chemin / cible
/app/secrets.json
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « rce-0 » · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 63
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0496
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Secrets JSON file
Ligne de requête
GET /app/secrets.json HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 8.0.0; SAMSUNG SM-N935F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/9.4 Chrome/67.0.3396.87 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /app/secrets.json HTTP/1.1
Host: 62.3.50.33:9900
User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SAMSUNG SM-N935F Build/R16
Requête brute (extrait)
GET /app/secrets.json HTTP/1.1 Host: 62.3.50.33:9900 User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SAMSUNG SM-N935F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/9.4 Chrome/67.0.3396.87 Mobile Safari/537.36 Accept-Charset: utf-8 A
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "2187b42e18798edd10331951dd462d0ca22c00f0",
"http_host_hash": "644bf1e7d4424d875bb198a2d6fada630a6b209e",
"http_target_hash": "a462f95e4a92cffbf9052da8b5be7c71cd3d0f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 299,
"payload_entropy": 5.508132629967388,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "KR",
"dst_port": 9900,
"risk_waf": 84,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 63,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "4bf12cc5e57f4da7447fb93105837548b2ea8ade",
"event_fingerprint": "a437efc89165a974f84a0497f7a583218baf90cd",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 135,
"precision_signals": [
"pat-0496",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"pat-0496",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0496"
],
"matched_pattern_names": [
"Cred Secrets JSON file"
],
"pattern_ids": [
"pat-0496"
],
"confidence_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "4a26b92d9bb0b7feecc8141ff70c6029",
"payload_hash": "3642b24e52fe01ef43d2b2cd15369ad0",
"path_pattern_hash": "fde58f9faead7388f9a511e05901ca16"
},
"target_context": {
"dst_port": 9900,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "GET \/app\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG SM-N935F Build\/R16",
"method": "GET",
"path": "\/app\/secrets.json",
"user_agent": "Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG SM-N935F Build\/R16NW) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBrowser\/9.4 Chrome\/67.0.3396.87 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/app\/secrets.json HTTP\/1.1",
"request_sample": "GET \/app\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG SM-N935F Build\/R16NW) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBrowser\/9.4 Chrome\/67.0.3396.87 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nA",
"payload_snippet": "GET \/app\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG SM-N935F Build\/R16",
"evidence": {
"method": "GET",
"path": "\/app\/secrets.json",
"user_agent": "Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG SM-N935F Build\/R16NW) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBrowser\/9.4 Chrome\/67.0.3396.87 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/app\/secrets.json HTTP\/1.1",
"request_sample": "GET \/app\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG SM-N935F Build\/R16NW) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBrowser\/9.4 Chrome\/67.0.3396.87 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nA",
"payload_snippet": "GET \/app\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG SM-N935F Build\/R16",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bbd9ded6382a9181cfd7f8436f8982be7c3977dd",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/secrets.json",
"request_line": "GET \/app\/secrets.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG SM-N935F Build\/R16NW) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBrowser\/\u2026",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/app\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG SM-N935F Build\/R16",
"attack_vector": "credential file probe \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/secrets.json",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9900,
"protocol_emulated": null,
"tags_summary": [
"pat-0496",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"pat-0496",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/secrets.json",
"request_line": "GET \/app\/secrets.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG SM-N935F Build\/R16NW) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBrowser\/\u2026",
"port": 9900,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:9900 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/secrets.json",
"evidence_snippet": "GET \/app\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:9900\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG SM-N935F Build\/R16",
"target_port_label": "9900 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_k8s_probe",
"net_flood"
],
"asn_dc_heuristic": true
}