14/06/2026 16:02:08 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /sendgrid/.env.prod
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /sendgrid/.env.prod UA Mozilla/5.0 (Windows NT 6.0; WOW64; rv:40.0) Gecko/20100101 Fir…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/sendgrid/.env.prod
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/sendgrid/.env.prod
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /sendgrid/.env.prod HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.0; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /sendgrid/.env.prod HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:40.0) Gecko/20100101
Requête brute (extrait)
GET /sendgrid/.env.prod HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "prod",
"http_ua_hash": "3cf0debc605382d7a7ef33875f597cbbd641f57c",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "0d25707b0f08affaf044e5e5e4a9b372cf0e8d19",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 210,
"payload_entropy": 5.27672405633255,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "0a29d72c394fcba0c14da0678f1848da05a5a5c6",
"event_fingerprint": "2f7d7433262b037bfcce0f5750fc337a8a5a8383",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "85b9b888cff39994fc04616f4ff27df2",
"payload_hash": "ce9527cb2f54901b6a4bcb8383b423f7",
"path_pattern_hash": "7b6f2bf53da3271b0003640b70d40226"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/sendgrid\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.0; WOW64; rv:40.0) Gecko\/20100101",
"method": "GET",
"path": "\/sendgrid\/.env.prod",
"user_agent": "Mozilla\/5.0 (Windows NT 6.0; WOW64; rv:40.0) Gecko\/20100101 Firefox\/40.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/sendgrid\/.env.prod HTTP\/1.1",
"request_sample": "GET \/sendgrid\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.0; WOW64; rv:40.0) Gecko\/20100101 Firefox\/40.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sendgrid\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.0; WOW64; rv:40.0) Gecko\/20100101",
"evidence": {
"method": "GET",
"path": "\/sendgrid\/.env.prod",
"user_agent": "Mozilla\/5.0 (Windows NT 6.0; WOW64; rv:40.0) Gecko\/20100101 Firefox\/40.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/sendgrid\/.env.prod HTTP\/1.1",
"request_sample": "GET \/sendgrid\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.0; WOW64; rv:40.0) Gecko\/20100101 Firefox\/40.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sendgrid\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.0; WOW64; rv:40.0) Gecko\/20100101",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ed87fc0f321988bc4c525e343fd7c3771cc0165a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid\/.env.prod",
"request_line": "GET \/sendgrid\/.env.prod HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.0; WOW64; rv:40.0) Gecko\/20100101 Firefox\/40.0",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sendgrid\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.0; WOW64; rv:40.0) Gecko\/20100101",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid\/.env.prod",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid\/.env.prod",
"request_line": "GET \/sendgrid\/.env.prod HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.0; WOW64; rv:40.0) Gecko\/20100101 Firefox\/40.0",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid\/.env.prod",
"evidence_snippet": "GET \/sendgrid\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.0; WOW64; rv:40.0) Gecko\/20100101",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:07 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /dashboard/.env
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /dashboard/.env UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_2) AppleWebKit/537…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/dashboard/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/dashboard/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /dashboard/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /dashboard/.env HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_2) AppleWebKit/537
Requête brute (extrait)
GET /dashboard/.env HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "69c4fbe696e55473397c35baf992c59dc1d4b297",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "a0df23adcbc250d22f3ea9c43cd45132cd7d119e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 255,
"payload_entropy": 5.426878250130368,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "9ac9b7e3d43d6ce13e8221beda9a91e559428c78",
"event_fingerprint": "453a86605f211a15f99032da425f349b8addb96e",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3175cf678edd8b13dd4903b120dcec2a",
"payload_hash": "6828704d0e6a019645c89034dbf29b19",
"path_pattern_hash": "90b830636acb1be7da7ed46e94f3bb1d"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/dashboard\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_2) AppleWebKit\/537",
"method": "GET",
"path": "\/dashboard\/.env",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/dashboard\/.env HTTP\/1.1",
"request_sample": "GET \/dashboard\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/dashboard\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_2) AppleWebKit\/537",
"evidence": {
"method": "GET",
"path": "\/dashboard\/.env",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/dashboard\/.env HTTP\/1.1",
"request_sample": "GET \/dashboard\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/dashboard\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_2) AppleWebKit\/537",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a9c412b695671ef2b25e0cb08fc7038b4dc4cacc",
"protocol_details": {
"http_method": "GET",
"http_path": "\/dashboard\/.env",
"request_line": "GET \/dashboard\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/dashboard\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_2) AppleWebKit\/537",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/dashboard\/.env",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/dashboard\/.env",
"request_line": "GET \/dashboard\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/dashboard\/.env",
"evidence_snippet": "GET \/dashboard\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_2) AppleWebKit\/537",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_probe_traefik",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:07 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /cms/.env
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /cms/.env UA grub-client-1.5.3; (grub-client-1.5.3; Crawl your own stuff wit…
Émulateur
HTTP
WAF
33
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/cms/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/cms/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /cms/.env HTTP/1.1
User-Agent
grub-client-1.5.3; (grub-client-1.5.3; Crawl your own stuff with http://grub.org)
Règles WAF
rce-0
ssrf-3
nosqli-3
leak-1
Payload (extrait)
GET /cms/.env HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: grub-client-1.5.3; (grub-client-1.5.3; Crawl your own stuff with http
Requête brute (extrait)
GET /cms/.env HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: grub-client-1.5.3; (grub-client-1.5.3; Crawl your own stuff with http://grub.org) Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "71db9053bdd13c7da9dd4c39adbdf0ed0813434b",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "83c0a8815eca606b22325f7ae33170918a4904ee",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 209,
"payload_entropy": 5.1586536161148056,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "ac91ea62cda83265b925c19e26799e18c7e31588",
"event_fingerprint": "5e58a21bb6e873b61ef041f8c6649e05612e6e2b",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e007145ba50bb31fd795f52669fba6cd",
"payload_hash": "e68684c4520ece0159dd4f332b30131d",
"path_pattern_hash": "202848a338e2a8411edbe9c852ffc90f"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/cms\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: grub-client-1.5.3; (grub-client-1.5.3; Crawl your own stuff with http",
"method": "GET",
"path": "\/cms\/.env",
"user_agent": "grub-client-1.5.3; (grub-client-1.5.3; Crawl your own stuff with http:\/\/grub.org)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/cms\/.env HTTP\/1.1",
"request_sample": "GET \/cms\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: grub-client-1.5.3; (grub-client-1.5.3; Crawl your own stuff with http:\/\/grub.org)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cms\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: grub-client-1.5.3; (grub-client-1.5.3; Crawl your own stuff with http",
"evidence": {
"method": "GET",
"path": "\/cms\/.env",
"user_agent": "grub-client-1.5.3; (grub-client-1.5.3; Crawl your own stuff with http:\/\/grub.org)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/cms\/.env HTTP\/1.1",
"request_sample": "GET \/cms\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: grub-client-1.5.3; (grub-client-1.5.3; Crawl your own stuff with http:\/\/grub.org)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cms\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: grub-client-1.5.3; (grub-client-1.5.3; Crawl your own stuff with http",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f4b4e1bcebea6c2568c44ad308a4960c6d183627",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cms\/.env",
"request_line": "GET \/cms\/.env HTTP\/1.1",
"http_user_agent": "grub-client-1.5.3; (grub-client-1.5.3; Crawl your own stuff with http:\/\/grub.org)",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/cms\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: grub-client-1.5.3; (grub-client-1.5.3; Crawl your own stuff with http",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cms\/.env",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cms\/.env",
"request_line": "GET \/cms\/.env HTTP\/1.1",
"http_user_agent": "grub-client-1.5.3; (grub-client-1.5.3; Crawl your own stuff with http:\/\/grub.org)",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cms\/.env",
"evidence_snippet": "GET \/cms\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: grub-client-1.5.3; (grub-client-1.5.3; Crawl your own stuff with http",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:07 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /services/auth/.env
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /services/auth/.env UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/services/auth/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/services/auth/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /services/auth/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /services/auth/.env HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit
Requête brute (extrait)
GET /services/auth/.env HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "env",
"http_ua_hash": "c9506acc9347b55f05450c94707c9cb4aa524734",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "09b20d19aa313f464eacd68829b3fab12fccb496",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 259,
"payload_entropy": 5.381608004730479,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "0a29d72c394fcba0c14da0678f1848da05a5a5c6",
"event_fingerprint": "28fea16aec6807c6838022a0444c86f35419ed60",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ee7427729c4b433d9a8072c1df5d53ba",
"payload_hash": "a6b4d6a07c50d1ff4026bee805b0f5f5",
"path_pattern_hash": "465b6d455db6ce12c0bb2d49f4cfba7e"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/services\/auth\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit",
"method": "GET",
"path": "\/services\/auth\/.env",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/services\/auth\/.env HTTP\/1.1",
"request_sample": "GET \/services\/auth\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r",
"payload_snippet": "GET \/services\/auth\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit",
"evidence": {
"method": "GET",
"path": "\/services\/auth\/.env",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/services\/auth\/.env HTTP\/1.1",
"request_sample": "GET \/services\/auth\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r",
"payload_snippet": "GET \/services\/auth\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "462ecac5cfe9a6d88db53f7a4a6e5de2bb0d999e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/services\/auth\/.env",
"request_line": "GET \/services\/auth\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Safari\/537.\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/services\/auth\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/services\/auth\/.env",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/services\/auth\/.env",
"request_line": "GET \/services\/auth\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Safari\/537.\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/services\/auth\/.env",
"evidence_snippet": "GET \/services\/auth\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:07 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /packages/api/.env
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /packages/api/.env UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/packages/api/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/packages/api/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /packages/api/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /packages/api/.env HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/
Requête brute (extrait)
GET /packages/api/.env HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "env",
"http_ua_hash": "c0b1c6fea9e36b2b8989207a63cd7c8313a8d192",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "fd8fe30f25c6601a86628e4b53931f0feb977f1a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 258,
"payload_entropy": 5.406713258952493,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "0a29d72c394fcba0c14da0678f1848da05a5a5c6",
"event_fingerprint": "146dbf3aec21e012d6883cfdbd8c67f1794a4a8a",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "283f8b434eda9742649e36405ad1c821",
"payload_hash": "d17fc08e36d56d702a54ac28900c6163",
"path_pattern_hash": "226ad246bf9a22935f1389885ad08c73"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/packages\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/",
"method": "GET",
"path": "\/packages\/api\/.env",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/packages\/api\/.env HTTP\/1.1",
"request_sample": "GET \/packages\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n",
"payload_snippet": "GET \/packages\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/",
"evidence": {
"method": "GET",
"path": "\/packages\/api\/.env",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/packages\/api\/.env HTTP\/1.1",
"request_sample": "GET \/packages\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n",
"payload_snippet": "GET \/packages\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2683810414beeadb558e7745844400ad5de849a1",
"protocol_details": {
"http_method": "GET",
"http_path": "\/packages\/api\/.env",
"request_line": "GET \/packages\/api\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/packages\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/packages\/api\/.env",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/packages\/api\/.env",
"request_line": "GET \/packages\/api\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/packages\/api\/.env",
"evidence_snippet": "GET \/packages\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:07 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /api/backend/.env
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /api/backend/.env UA Mozilla/5.0 (OS/2; Warp 4.5; rv:38.0) Gecko/20100101 Firefox/38…
Émulateur
HTTP
WAF
39
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/api/backend/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/api/backend/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « lfi-14 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 6 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /api/backend/.env HTTP/1.1
User-Agent
Mozilla/5.0 (OS/2; Warp 4.5; rv:38.0) Gecko/20100101 Firefox/38.0 SeaMonkey/2.35
Règles WAF
lfi-14
rce-0
nosqli-3
leak-1
k8s-api
Payload (extrait)
GET /api/backend/.env HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (OS/2; Warp 4.5; rv:38.0) Gecko/20100101 Firefox/
Requête brute (extrait)
GET /api/backend/.env HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (OS/2; Warp 4.5; rv:38.0) Gecko/20100101 Firefox/38.0 SeaMonkey/2.35 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "env",
"http_ua_hash": "1f69c22c1d5ce0976451c643172bc451fba0d85d",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "e525470447161ee4034567dbf14d4d4a54f52f46",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 216,
"payload_entropy": 5.307559476711723,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 10,
"anomaly_count": 0,
"campaign_key": "d965e4ee002c52d9e663bcc67edb1719165f3111",
"event_fingerprint": "bcd6b3091fe61c14e8eb96ba3c6634e61fbd7dfd",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3c9fca5e9d09253956ec994cf0f7558f",
"payload_hash": "e40c8065e6a5c5b74be0dbafd6bf16c4",
"path_pattern_hash": "ad852d1414999713ac2638aba79c8ff5"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/api\/backend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (OS\/2; Warp 4.5; rv:38.0) Gecko\/20100101 Firefox\/",
"method": "GET",
"path": "\/api\/backend\/.env",
"user_agent": "Mozilla\/5.0 (OS\/2; Warp 4.5; rv:38.0) Gecko\/20100101 Firefox\/38.0 SeaMonkey\/2.35",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3",
"leak-1",
"k8s-api"
],
"request_line": "GET \/api\/backend\/.env HTTP\/1.1",
"request_sample": "GET \/api\/backend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (OS\/2; Warp 4.5; rv:38.0) Gecko\/20100101 Firefox\/38.0 SeaMonkey\/2.35\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/api\/backend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (OS\/2; Warp 4.5; rv:38.0) Gecko\/20100101 Firefox\/",
"evidence": {
"method": "GET",
"path": "\/api\/backend\/.env",
"user_agent": "Mozilla\/5.0 (OS\/2; Warp 4.5; rv:38.0) Gecko\/20100101 Firefox\/38.0 SeaMonkey\/2.35",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3",
"leak-1",
"k8s-api"
],
"request_line": "GET \/api\/backend\/.env HTTP\/1.1",
"request_sample": "GET \/api\/backend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (OS\/2; Warp 4.5; rv:38.0) Gecko\/20100101 Firefox\/38.0 SeaMonkey\/2.35\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/api\/backend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (OS\/2; Warp 4.5; rv:38.0) Gecko\/20100101 Firefox\/",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "434b6ccb1cb199eabead46f586aa071ccee6796b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/backend\/.env",
"request_line": "GET \/api\/backend\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (OS\/2; Warp 4.5; rv:38.0) Gecko\/20100101 Firefox\/38.0 SeaMonkey\/2.35",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/backend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (OS\/2; Warp 4.5; rv:38.0) Gecko\/20100101 Firefox\/",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/backend\/.env",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/backend\/.env",
"request_line": "GET \/api\/backend\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (OS\/2; Warp 4.5; rv:38.0) Gecko\/20100101 Firefox\/38.0 SeaMonkey\/2.35",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/backend\/.env",
"evidence_snippet": "GET \/api\/backend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (OS\/2; Warp 4.5; rv:38.0) Gecko\/20100101 Firefox\/",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"950600:k8s-api",
"http_backup_file_scan",
"http_probe_api",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:07 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /services/backend/.env
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /services/backend/.env UA Mozilla/5.0 (Linux; Android 9; SAMSUNG SM-G950F Build/PPR1.1806…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/services/backend/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/services/backend/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /services/backend/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; SAMSUNG SM-G950F Build/PPR1.180610.011) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/9.4 Chrome/67.0.3396.87 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /services/backend/.env HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (Linux; Android 9; SAMSUNG SM-G950F Build/PP
Requête brute (extrait)
GET /services/backend/.env HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (Linux; Android 9; SAMSUNG SM-G950F Build/PPR1.180610.011) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/9.4 Chrome/67.0.3396.87 Mobile Safari/537.36 Accept-Charse
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "env",
"http_ua_hash": "613dafa250e9358a94a43c97ccf29e22838945bc",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "bff52174bd71304ed2bfcd7637238e2def0caff3",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 310,
"payload_entropy": 5.524788131129207,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "0a29d72c394fcba0c14da0678f1848da05a5a5c6",
"event_fingerprint": "97f3412e40ba5534eb06885004cc56c5d972e243",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "d61778609b7c61cacca39c0459ebfe15",
"payload_hash": "90f12770a5bda94b8b1a575a1d7518f5",
"path_pattern_hash": "5b9b007f982aa0909ed1fcbe7f087982"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/services\/backend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-G950F Build\/PP",
"method": "GET",
"path": "\/services\/backend\/.env",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-G950F Build\/PPR1.180610.011) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBrowser\/9.4 Chrome\/67.0.3396.87 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/services\/backend\/.env HTTP\/1.1",
"request_sample": "GET \/services\/backend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-G950F Build\/PPR1.180610.011) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBrowser\/9.4 Chrome\/67.0.3396.87 Mobile Safari\/537.36\r\nAccept-Charse",
"payload_snippet": "GET \/services\/backend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-G950F Build\/PP",
"evidence": {
"method": "GET",
"path": "\/services\/backend\/.env",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-G950F Build\/PPR1.180610.011) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBrowser\/9.4 Chrome\/67.0.3396.87 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/services\/backend\/.env HTTP\/1.1",
"request_sample": "GET \/services\/backend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-G950F Build\/PPR1.180610.011) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBrowser\/9.4 Chrome\/67.0.3396.87 Mobile Safari\/537.36\r\nAccept-Charse",
"payload_snippet": "GET \/services\/backend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-G950F Build\/PP",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "42b6247615456b82375f7376e968d751586d5029",
"protocol_details": {
"http_method": "GET",
"http_path": "\/services\/backend\/.env",
"request_line": "GET \/services\/backend\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-G950F Build\/PPR1.180610.011) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBr\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/services\/backend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-G950F Build\/PP",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/services\/backend\/.env",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/services\/backend\/.env",
"request_line": "GET \/services\/backend\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-G950F Build\/PPR1.180610.011) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBr\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/services\/backend\/.env",
"evidence_snippet": "GET \/services\/backend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-G950F Build\/PP",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:07 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /sendgrid/.env
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /sendgrid/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/sendgrid/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/sendgrid/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /sendgrid/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.10 Safari/537.36 Edg/77.0.235.5
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /sendgrid/.env HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KH
Requête brute (extrait)
GET /sendgrid/.env HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.10 Safari/537.36 Edg/77.0.235.5 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: clo
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "3862d9c82764603f01895b6fbe812ba287bc904f",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "32cb56247a35cc80b26561f128c72366c9be4e97",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 262,
"payload_entropy": 5.401985622864681,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "0a29d72c394fcba0c14da0678f1848da05a5a5c6",
"event_fingerprint": "0c15b6985e1c143038aa8d70c9e24ca9c96983dc",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "69da0ec884a4cabd672cf7b733d58e25",
"payload_hash": "6c12c1290d32d4411ec902b9858664c0",
"path_pattern_hash": "777e785d116a3190d6333410abb382c9"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/sendgrid\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KH",
"method": "GET",
"path": "\/sendgrid\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/77.0.3865.10 Safari\/537.36 Edg\/77.0.235.5",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/sendgrid\/.env HTTP\/1.1",
"request_sample": "GET \/sendgrid\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/77.0.3865.10 Safari\/537.36 Edg\/77.0.235.5\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: clo",
"payload_snippet": "GET \/sendgrid\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KH",
"evidence": {
"method": "GET",
"path": "\/sendgrid\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/77.0.3865.10 Safari\/537.36 Edg\/77.0.235.5",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/sendgrid\/.env HTTP\/1.1",
"request_sample": "GET \/sendgrid\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/77.0.3865.10 Safari\/537.36 Edg\/77.0.235.5\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: clo",
"payload_snippet": "GET \/sendgrid\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KH",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "51188870d6f71a741b4f8c0285c5551a72b7c01e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid\/.env",
"request_line": "GET \/sendgrid\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/77.0.3865.10 Safari\/537.36 Edg\/\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sendgrid\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KH",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid\/.env",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid\/.env",
"request_line": "GET \/sendgrid\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/77.0.3865.10 Safari\/537.36 Edg\/\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid\/.env",
"evidence_snippet": "GET \/sendgrid\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KH",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:07 UTC
TCP
8260 · HTTP
Flood / DDoS
http flood · via HTTP:8260 · (tentative d'exploit) · → /app/sendgrid.env
Élevée
Moyen · 62
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /app/sendgrid.env UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/app/sendgrid.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/app/sendgrid.env
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 62
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /app/sendgrid.env HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /app/sendgrid.env HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, li
Requête brute (extrait)
GET /app/sendgrid.env HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "f760028a61f65c04d10a13222b8e7ca442a58caa",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "c4e386f94f6eeabfd7559193ad14662c752c4a14",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 240,
"payload_entropy": 5.424745971259903,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 62,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "c640df7b65b38add5a59a4ed5e54755b606ed5d8",
"event_fingerprint": "39be731e8b78acb194d2860322cd60903a24fe33",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "211b4081a4895824f9f6e17d2b76ccd8",
"payload_hash": "0bd9e9b98da27412a95f2cc8aa947227",
"path_pattern_hash": "6261a164ed75d70d1161dccf152278f4"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 62
},
"payload_preview": "GET \/app\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, li",
"method": "GET",
"path": "\/app\/sendgrid.env",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.75 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/app\/sendgrid.env HTTP\/1.1",
"request_sample": "GET \/app\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.75 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/app\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, li",
"evidence": {
"method": "GET",
"path": "\/app\/sendgrid.env",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.75 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/app\/sendgrid.env HTTP\/1.1",
"request_sample": "GET \/app\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.75 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/app\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, li",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7f5357ccaeb2dc83082784f95d3a6f20f0c1a102",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/sendgrid.env",
"request_line": "GET \/app\/sendgrid.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.75 Safari\/537.36",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/app\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, li",
"attack_vector": "http flood \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/sendgrid.env",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 62,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/sendgrid.env",
"request_line": "GET \/app\/sendgrid.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.75 Safari\/537.36",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/sendgrid.env",
"evidence_snippet": "GET \/app\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, li",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:07 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /service/.env
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /service/.env UA Gaisbot/3.0 (robot@gais.cs.ccu.edu.tw; http://gais.cs.ccu.edu.t…
Émulateur
HTTP
WAF
49
Recommandation
Investiguer
Tags
950310:lfi-12
950318:lfi-14
950326:rce-0
950406:ssrf-3
Cible HTTP
GET
/service/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/service/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « lfi-12 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 7 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /service/.env HTTP/1.1
User-Agent
Gaisbot/3.0 (robot@gais.cs.ccu.edu.tw; http://gais.cs.ccu.edu.tw/robot.php)
Règles WAF
lfi-12
lfi-14
rce-0
ssrf-3
nosqli-3
leak-1
Payload (extrait)
GET /service/.env HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Gaisbot/3.0 (robot@gais.cs.ccu.edu.tw; http://gais.cs.ccu.edu.tw/
Requête brute (extrait)
GET /service/.env HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Gaisbot/3.0 (robot@gais.cs.ccu.edu.tw; http://gais.cs.ccu.edu.tw/robot.php) Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "e303cafa16cffb83fe9920e4b803b7bfce58cd74",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "9afb54f0e738d3d8aa1fcfb80bab77080f7f6fdc",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 207,
"payload_entropy": 5.065594871324637,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 10,
"anomaly_count": 0,
"campaign_key": "5f2b586dfd56e63331f03fc1ec2d9bf2d74f5e6b",
"event_fingerprint": "b32aa8f7b7b9c11b8c35d705fec44075d577d60c",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-12 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "715818dd0b717f3460b481c0fc9c521d",
"payload_hash": "865923b30441c1af2936844a1acfffb3",
"path_pattern_hash": "d9b00f587478dec270837253c672f652"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/service\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Gaisbot\/3.0 (robot@gais.cs.ccu.edu.tw; http:\/\/gais.cs.ccu.edu.tw\/",
"method": "GET",
"path": "\/service\/.env",
"user_agent": "Gaisbot\/3.0 (robot@gais.cs.ccu.edu.tw; http:\/\/gais.cs.ccu.edu.tw\/robot.php)",
"waf_tags": [
"950310:lfi-12",
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-12",
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/service\/.env HTTP\/1.1",
"request_sample": "GET \/service\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Gaisbot\/3.0 (robot@gais.cs.ccu.edu.tw; http:\/\/gais.cs.ccu.edu.tw\/robot.php)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/service\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Gaisbot\/3.0 (robot@gais.cs.ccu.edu.tw; http:\/\/gais.cs.ccu.edu.tw\/",
"evidence": {
"method": "GET",
"path": "\/service\/.env",
"user_agent": "Gaisbot\/3.0 (robot@gais.cs.ccu.edu.tw; http:\/\/gais.cs.ccu.edu.tw\/robot.php)",
"waf_tags": [
"950310:lfi-12",
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-12",
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/service\/.env HTTP\/1.1",
"request_sample": "GET \/service\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Gaisbot\/3.0 (robot@gais.cs.ccu.edu.tw; http:\/\/gais.cs.ccu.edu.tw\/robot.php)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/service\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Gaisbot\/3.0 (robot@gais.cs.ccu.edu.tw; http:\/\/gais.cs.ccu.edu.tw\/",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-12 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0f26232e7e9af9c0f5a8379933d9520dfc4661c8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/service\/.env",
"request_line": "GET \/service\/.env HTTP\/1.1",
"http_user_agent": "Gaisbot\/3.0 (robot@gais.cs.ccu.edu.tw; http:\/\/gais.cs.ccu.edu.tw\/robot.php)",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/service\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Gaisbot\/3.0 (robot@gais.cs.ccu.edu.tw; http:\/\/gais.cs.ccu.edu.tw\/",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/service\/.env",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-12 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-12 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/service\/.env",
"request_line": "GET \/service\/.env HTTP\/1.1",
"http_user_agent": "Gaisbot\/3.0 (robot@gais.cs.ccu.edu.tw; http:\/\/gais.cs.ccu.edu.tw\/robot.php)",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/service\/.env",
"evidence_snippet": "GET \/service\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Gaisbot\/3.0 (robot@gais.cs.ccu.edu.tw; http:\/\/gais.cs.ccu.edu.tw\/",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950310:lfi-12",
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:07 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /apps/backend/.env
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /apps/backend/.env UA Mozilla/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit/537.36 (…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/apps/backend/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/apps/backend/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /apps/backend/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /apps/backend/.env HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit/537.3
Requête brute (extrait)
GET /apps/backend/.env HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "env",
"http_ua_hash": "3160c2e9878e0fe397da006c34bfeb6f3f44a29f",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "5342af8e96c105cf859dad12eed2c40aaf87d35d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 260,
"payload_entropy": 5.431594478210157,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "0a29d72c394fcba0c14da0678f1848da05a5a5c6",
"event_fingerprint": "742a62d057b759fde44ad922498850dad747bba5",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "622d2920bfec1abd80604bdcdf49d52c",
"payload_hash": "5b04c55e4ec1e86229de52f6f276f5ea",
"path_pattern_hash": "cfddbf55f677ac93c8dcc5d08054758b"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/apps\/backend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit\/537.3",
"method": "GET",
"path": "\/apps\/backend\/.env",
"user_agent": "Mozilla\/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/apps\/backend\/.env HTTP\/1.1",
"request_sample": "GET \/apps\/backend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close",
"payload_snippet": "GET \/apps\/backend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit\/537.3",
"evidence": {
"method": "GET",
"path": "\/apps\/backend\/.env",
"user_agent": "Mozilla\/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/apps\/backend\/.env HTTP\/1.1",
"request_sample": "GET \/apps\/backend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close",
"payload_snippet": "GET \/apps\/backend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit\/537.3",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "448f522ddc0b1ba0b35500c710cc6202ff7736d7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/apps\/backend\/.env",
"request_line": "GET \/apps\/backend\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Mobile Safari\/53\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/apps\/backend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit\/537.3",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/apps\/backend\/.env",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/apps\/backend\/.env",
"request_line": "GET \/apps\/backend\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Mobile Safari\/53\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/apps\/backend\/.env",
"evidence_snippet": "GET \/apps\/backend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit\/537.3",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:07 UTC
TCP
8260 · HTTP
Flood / DDoS
http flood · via HTTP:8260 · (tentative d'exploit) · → /config/sendgrid.env
Élevée
Moyen · 63
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /config/sendgrid.env UA Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML,…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_probe_config
Cible HTTP
GET
/config/sendgrid.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/config/sendgrid.env
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 63
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /config/sendgrid.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Whale/1.5.75.9 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /config/sendgrid.env HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (K
Requête brute (extrait)
GET /config/sendgrid.env HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Whale/1.5.75.9 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: c
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "067058af17545b8aa9a331a4d994972b878b7a36",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "442d1e47f2d87d2eb61cbc03306278922032dd94",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 264,
"payload_entropy": 5.4002595255116805,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 63,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "4fb01028a7917d1fb3c9ec9b893bfd77f500634f",
"event_fingerprint": "cac3c7c6763a538fa1240d4bb92271bf7115bb23",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2faef40da198a6b2c9df1e4b3e8a34f9",
"payload_hash": "a9be9037873f59bbffde268f8a52ee86",
"path_pattern_hash": "063c352cd871139979301d261825ea56"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "GET \/config\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (K",
"method": "GET",
"path": "\/config\/sendgrid.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Whale\/1.5.75.9 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/sendgrid.env HTTP\/1.1",
"request_sample": "GET \/config\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Whale\/1.5.75.9 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: c",
"payload_snippet": "GET \/config\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (K",
"evidence": {
"method": "GET",
"path": "\/config\/sendgrid.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Whale\/1.5.75.9 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/sendgrid.env HTTP\/1.1",
"request_sample": "GET \/config\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Whale\/1.5.75.9 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: c",
"payload_snippet": "GET \/config\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (K",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1220b6c925fe6197715e6066ec602430b4ae10c2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/sendgrid.env",
"request_line": "GET \/config\/sendgrid.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Whale\/1.5.75.9 Safari\/\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (K",
"attack_vector": "http flood \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/sendgrid.env",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/sendgrid.env",
"request_line": "GET \/config\/sendgrid.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Whale\/1.5.75.9 Safari\/\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/sendgrid.env",
"evidence_snippet": "GET \/config\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (K",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_config",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:07 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /sendgrid/.env.local
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /sendgrid/.env.local UA Mozilla/5.0 (Linux; Android 9; SM-G960U) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/sendgrid/.env.local
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/sendgrid/.env.local
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /sendgrid/.env.local HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; SM-G960U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /sendgrid/.env.local HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (Linux; Android 9; SM-G960U) AppleWebKit/537.3
Requête brute (extrait)
GET /sendgrid/.env.local HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (Linux; Android 9; SM-G960U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "local",
"http_ua_hash": "4514010d1c861fb109480127dbf6ae2989d67e77",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "767e9db7005d9cdf6cd3331a30730b9d5e7035c7",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 260,
"payload_entropy": 5.409567727431632,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "0a29d72c394fcba0c14da0678f1848da05a5a5c6",
"event_fingerprint": "40822c129e8b66e4654e166a61db68844cf5eaf3",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e3f6b886cb1e47721b07ce96d2990f88",
"payload_hash": "4a08a4190fc8392798ccd68a049d5e0e",
"path_pattern_hash": "8797b46839a2325b1bc3ba5ac4c03fde"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/sendgrid\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G960U) AppleWebKit\/537.3",
"method": "GET",
"path": "\/sendgrid\/.env.local",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; SM-G960U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/sendgrid\/.env.local HTTP\/1.1",
"request_sample": "GET \/sendgrid\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G960U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close",
"payload_snippet": "GET \/sendgrid\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G960U) AppleWebKit\/537.3",
"evidence": {
"method": "GET",
"path": "\/sendgrid\/.env.local",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; SM-G960U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/sendgrid\/.env.local HTTP\/1.1",
"request_sample": "GET \/sendgrid\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G960U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close",
"payload_snippet": "GET \/sendgrid\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G960U) AppleWebKit\/537.3",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b3cff624b986d7534a336510c815ba3cfa84033d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid\/.env.local",
"request_line": "GET \/sendgrid\/.env.local HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; SM-G960U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sendgrid\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G960U) AppleWebKit\/537.3",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid\/.env.local",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid\/.env.local",
"request_line": "GET \/sendgrid\/.env.local HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; SM-G960U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid\/.env.local",
"evidence_snippet": "GET \/sendgrid\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G960U) AppleWebKit\/537.3",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:07 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /sendgrid/.env.backup
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /sendgrid/.env.backup UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit/537…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/sendgrid/.env.backup
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/sendgrid/.env.backup
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /sendgrid/.env.backup HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /sendgrid/.env.backup HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebK
Requête brute (extrait)
GET /sendgrid/.env.backup HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: clos
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "backup",
"http_ua_hash": "2129e249a959ffd0db6ad3b44bf327cbe55b14a7",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "7414e954936369312216016b538bc4f9a2118512",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 261,
"payload_entropy": 5.445810687315291,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "0a29d72c394fcba0c14da0678f1848da05a5a5c6",
"event_fingerprint": "a81abac7b653e8de9f833bd92d38a1c587d39b7a",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ba0c0c03e52fbdbadeffc65b0b5ce835",
"payload_hash": "6cf0d49364ff1a3fbb1373ac29208032",
"path_pattern_hash": "19193774c73c1aaa5564e645d1415a95"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/sendgrid\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebK",
"method": "GET",
"path": "\/sendgrid\/.env.backup",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.169 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/sendgrid\/.env.backup HTTP\/1.1",
"request_sample": "GET \/sendgrid\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.169 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: clos",
"payload_snippet": "GET \/sendgrid\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebK",
"evidence": {
"method": "GET",
"path": "\/sendgrid\/.env.backup",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.169 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/sendgrid\/.env.backup HTTP\/1.1",
"request_sample": "GET \/sendgrid\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.169 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: clos",
"payload_snippet": "GET \/sendgrid\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebK",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7dda3c004721a240311b2e358fc90583ac851868",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid\/.env.backup",
"request_line": "GET \/sendgrid\/.env.backup HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.169 Safari\/537.\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sendgrid\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebK",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid\/.env.backup",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid\/.env.backup",
"request_line": "GET \/sendgrid\/.env.backup HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.169 Safari\/537.\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid\/.env.backup",
"evidence_snippet": "GET \/sendgrid\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebK",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:07 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /apps/frontend/.env
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /apps/frontend/.env UA Mozilla/5.0 (Linux; Android 8.1.0; vivo 1807) AppleWebKit/537.3…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/apps/frontend/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/apps/frontend/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /apps/frontend/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 8.1.0; vivo 1807) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.99 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /apps/frontend/.env HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (Linux; Android 8.1.0; vivo 1807) AppleWebKit/5
Requête brute (extrait)
GET /apps/frontend/.env HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (Linux; Android 8.1.0; vivo 1807) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.99 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: cl
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "env",
"http_ua_hash": "e8b1c69e533ecd2a1b85bb980977e549cc580593",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "ba0ce57a366071a1ca1afd15a1a01a04ccdd2335",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 263,
"payload_entropy": 5.385434463164543,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "0a29d72c394fcba0c14da0678f1848da05a5a5c6",
"event_fingerprint": "bff896196b265edc9708ca30349ac924e90898ed",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "81a00c8ffee4949501a740c797596054",
"payload_hash": "12b7704342dc464279e8801a34934c4e",
"path_pattern_hash": "a541762358ad3d2463e9e9180528a6a3"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/apps\/frontend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; vivo 1807) AppleWebKit\/5",
"method": "GET",
"path": "\/apps\/frontend\/.env",
"user_agent": "Mozilla\/5.0 (Linux; Android 8.1.0; vivo 1807) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/71.0.3578.99 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/apps\/frontend\/.env HTTP\/1.1",
"request_sample": "GET \/apps\/frontend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; vivo 1807) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/71.0.3578.99 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: cl",
"payload_snippet": "GET \/apps\/frontend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; vivo 1807) AppleWebKit\/5",
"evidence": {
"method": "GET",
"path": "\/apps\/frontend\/.env",
"user_agent": "Mozilla\/5.0 (Linux; Android 8.1.0; vivo 1807) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/71.0.3578.99 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/apps\/frontend\/.env HTTP\/1.1",
"request_sample": "GET \/apps\/frontend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; vivo 1807) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/71.0.3578.99 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: cl",
"payload_snippet": "GET \/apps\/frontend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; vivo 1807) AppleWebKit\/5",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "922d870d611b5b1b6a278c9c2ca63a5514f2cd63",
"protocol_details": {
"http_method": "GET",
"http_path": "\/apps\/frontend\/.env",
"request_line": "GET \/apps\/frontend\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 8.1.0; vivo 1807) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/71.0.3578.99 Mobile Safari\/\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/apps\/frontend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; vivo 1807) AppleWebKit\/5",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/apps\/frontend\/.env",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/apps\/frontend\/.env",
"request_line": "GET \/apps\/frontend\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 8.1.0; vivo 1807) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/71.0.3578.99 Mobile Safari\/\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/apps\/frontend\/.env",
"evidence_snippet": "GET \/apps\/frontend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; vivo 1807) AppleWebKit\/5",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:07 UTC
TCP
8260 · HTTP
Flood / DDoS
http flood · via HTTP:8260 · (tentative d'exploit) · → /src/sendgrid.env
Élevée
Moyen · 62
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /src/sendgrid.env UA Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWeb…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/src/sendgrid.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/src/sendgrid.env
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 62
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /src/sendgrid.env HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A356 Safari/604.1
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /src/sendgrid.env HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleW
Requête brute (extrait)
GET /src/sendgrid.env HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A356 Safari/604.1 Accept-Charset: utf-8 Accept-Encoding: gzip Connec
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "b1ea358c1a362484dc783cbababe861b73312cce",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "65ab1a4a4b69eaa754edacfbad2ed06d355ae77f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 271,
"payload_entropy": 5.355613760764003,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 62,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "c640df7b65b38add5a59a4ed5e54755b606ed5d8",
"event_fingerprint": "dbc6c494196b087fdd4054d9997315f0e0636e39",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "587efac4fdf21515ded6747b7b58c3d4",
"payload_hash": "3c7e58df2a6c255b3b83e0f290e702a6",
"path_pattern_hash": "37297d51019b5c4aaeb2b2f7ef330082"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 62
},
"payload_preview": "GET \/src\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleW",
"method": "GET",
"path": "\/src\/sendgrid.env",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit\/604.1.38 (KHTML, like Gecko) Version\/11.0 Mobile\/15A356 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/src\/sendgrid.env HTTP\/1.1",
"request_sample": "GET \/src\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit\/604.1.38 (KHTML, like Gecko) Version\/11.0 Mobile\/15A356 Safari\/604.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnec",
"payload_snippet": "GET \/src\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleW",
"evidence": {
"method": "GET",
"path": "\/src\/sendgrid.env",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit\/604.1.38 (KHTML, like Gecko) Version\/11.0 Mobile\/15A356 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/src\/sendgrid.env HTTP\/1.1",
"request_sample": "GET \/src\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit\/604.1.38 (KHTML, like Gecko) Version\/11.0 Mobile\/15A356 Safari\/604.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnec",
"payload_snippet": "GET \/src\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleW",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "50f5a85bdf69e5c984c5916a27babc628c90b2ef",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/sendgrid.env",
"request_line": "GET \/src\/sendgrid.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit\/604.1.38 (KHTML, like Gecko) Version\/11.0 Mobile\/15A\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/src\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleW",
"attack_vector": "http flood \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/sendgrid.env",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 62,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/sendgrid.env",
"request_line": "GET \/src\/sendgrid.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit\/604.1.38 (KHTML, like Gecko) Version\/11.0 Mobile\/15A\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/sendgrid.env",
"evidence_snippet": "GET \/src\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleW",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:07 UTC
TCP
8260 · HTTP
Flood / DDoS
http flood · via HTTP:8260 · (tentative d'exploit) · → /sendgrid.env
Élevée
Moyen · 54
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /sendgrid.env UA Mozilla/5.0 (Linux; Android 9; Moto Z3 Play) AppleWebKit/537.36…
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
net_flood
Cible HTTP
GET
/sendgrid.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/sendgrid.env
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /sendgrid.env HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; Moto Z3 Play) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /sendgrid.env HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (Linux; Android 9; Moto Z3 Play) AppleWebKit/537.36 (
Requête brute (extrait)
GET /sendgrid.env HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (Linux; Android 9; Moto Z3 Play) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "env",
"http_ua_hash": "b5f3cfc9aac8f40ab78abbd74d626a60daca3aa9",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "3719861ea949dc2f70a7ae8ced2a838a6837f706",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 257,
"payload_entropy": 5.407074550728032,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 60,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 54,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "07988f3309d64461ad8ab093944f0a2f453f1c9a",
"event_fingerprint": "821ec0f12b82f914f206f2cb79ccabb081a56a7f",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "b8b4cdbcca20c508aff568ee71d510f9",
"payload_hash": "ddbe1fd9dd4af83b985215134de84a21",
"path_pattern_hash": "ca36907c59a1a3482046c81a2d773198"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; Moto Z3 Play) AppleWebKit\/537.36 (",
"method": "GET",
"path": "\/sendgrid.env",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; Moto Z3 Play) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/sendgrid.env HTTP\/1.1",
"request_sample": "GET \/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; Moto Z3 Play) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r",
"payload_snippet": "GET \/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; Moto Z3 Play) AppleWebKit\/537.36 (",
"evidence": {
"method": "GET",
"path": "\/sendgrid.env",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; Moto Z3 Play) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/sendgrid.env HTTP\/1.1",
"request_sample": "GET \/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; Moto Z3 Play) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r",
"payload_snippet": "GET \/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; Moto Z3 Play) AppleWebKit\/537.36 (",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ddfc97a046e613f9d2ee4499e52e01ce47334e28",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid.env",
"request_line": "GET \/sendgrid.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; Moto Z3 Play) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; Moto Z3 Play) AppleWebKit\/537.36 (",
"attack_vector": "http flood \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid.env",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid.env",
"request_line": "GET \/sendgrid.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; Moto Z3 Play) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid.env",
"evidence_snippet": "GET \/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; Moto Z3 Play) AppleWebKit\/537.36 (",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:07 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /apps/api/.env
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /apps/api/.env UA Mozilla/5.0 (Linux; Android 4.0.4; BNTV400 Build/IMM76L) AppleW…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/apps/api/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/apps/api/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /apps/api/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 4.0.4; BNTV400 Build/IMM76L) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.111 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /apps/api/.env HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (Linux; Android 4.0.4; BNTV400 Build/IMM76L) AppleWe
Requête brute (extrait)
GET /apps/api/.env HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (Linux; Android 4.0.4; BNTV400 Build/IMM76L) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.111 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: cl
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "env",
"http_ua_hash": "b872393454d8679ae61da75ad761a12f6c96eef0",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "e63b41d5687406ee7f40926b7271357b1c46aaae",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 263,
"payload_entropy": 5.47380645789557,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "0a29d72c394fcba0c14da0678f1848da05a5a5c6",
"event_fingerprint": "3d45070bf6b106ec7b537864e7fc4225e1de334f",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "531b6c86ae06578596b1078f2ca6eb01",
"payload_hash": "e3b430223856c64b3ae3ed21ce71c3d4",
"path_pattern_hash": "ab70800db05dbfe0190629bc711f2fa2"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/apps\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 4.0.4; BNTV400 Build\/IMM76L) AppleWe",
"method": "GET",
"path": "\/apps\/api\/.env",
"user_agent": "Mozilla\/5.0 (Linux; Android 4.0.4; BNTV400 Build\/IMM76L) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/42.0.2311.111 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/apps\/api\/.env HTTP\/1.1",
"request_sample": "GET \/apps\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 4.0.4; BNTV400 Build\/IMM76L) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/42.0.2311.111 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: cl",
"payload_snippet": "GET \/apps\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 4.0.4; BNTV400 Build\/IMM76L) AppleWe",
"evidence": {
"method": "GET",
"path": "\/apps\/api\/.env",
"user_agent": "Mozilla\/5.0 (Linux; Android 4.0.4; BNTV400 Build\/IMM76L) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/42.0.2311.111 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/apps\/api\/.env HTTP\/1.1",
"request_sample": "GET \/apps\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 4.0.4; BNTV400 Build\/IMM76L) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/42.0.2311.111 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: cl",
"payload_snippet": "GET \/apps\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 4.0.4; BNTV400 Build\/IMM76L) AppleWe",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9d3a101d401a4a6955bd75a2b101b21b4b701b89",
"protocol_details": {
"http_method": "GET",
"http_path": "\/apps\/api\/.env",
"request_line": "GET \/apps\/api\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 4.0.4; BNTV400 Build\/IMM76L) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/42.0.2311.111 Sa\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/apps\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 4.0.4; BNTV400 Build\/IMM76L) AppleWe",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/apps\/api\/.env",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/apps\/api\/.env",
"request_line": "GET \/apps\/api\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 4.0.4; BNTV400 Build\/IMM76L) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/42.0.2311.111 Sa\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/apps\/api\/.env",
"evidence_snippet": "GET \/apps\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 4.0.4; BNTV400 Build\/IMM76L) AppleWe",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:07 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /sendgrid/.env.production
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /sendgrid/.env.production UA Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.16) Gecko/2008…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/sendgrid/.env.production
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/sendgrid/.env.production
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /sendgrid/.env.production HTTP/1.1
User-Agent
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.16) Gecko/20080716 (Gentoo) Galeon/2.0.6
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /sendgrid/.env.production HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.16)
Requête brute (extrait)
GET /sendgrid/.env.production HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.16) Gecko/20080716 (Gentoo) Galeon/2.0.6 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "production",
"http_ua_hash": "ee51e06bab42e31123dc56d3e7441fe31d3bdca8",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "15c901ce89f04ab49d92ce30544afd5e7fe875d5",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 233,
"payload_entropy": 5.237386715890298,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "0a29d72c394fcba0c14da0678f1848da05a5a5c6",
"event_fingerprint": "ddd52f367a06b830fbe979c093f0ef0f23a202db",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7c03a0ceb5e41705263eecefeb91e5ab",
"payload_hash": "c0efaeae04c631f4ba08f52102473809",
"path_pattern_hash": "372a0d709ccb756df0c1c71eb9496ec6"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/sendgrid\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.16) ",
"method": "GET",
"path": "\/sendgrid\/.env.production",
"user_agent": "Mozilla\/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.16) Gecko\/20080716 (Gentoo) Galeon\/2.0.6",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/sendgrid\/.env.production HTTP\/1.1",
"request_sample": "GET \/sendgrid\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.16) Gecko\/20080716 (Gentoo) Galeon\/2.0.6\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sendgrid\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.16)",
"evidence": {
"method": "GET",
"path": "\/sendgrid\/.env.production",
"user_agent": "Mozilla\/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.16) Gecko\/20080716 (Gentoo) Galeon\/2.0.6",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/sendgrid\/.env.production HTTP\/1.1",
"request_sample": "GET \/sendgrid\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.16) Gecko\/20080716 (Gentoo) Galeon\/2.0.6\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sendgrid\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.16)",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "56244efe32fd1f3f79e9ad3a6638e739fb64dc55",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid\/.env.production",
"request_line": "GET \/sendgrid\/.env.production HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.16) Gecko\/20080716 (Gentoo) Galeon\/2.0.6",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sendgrid\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.16)",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid\/.env.production",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid\/.env.production",
"request_line": "GET \/sendgrid\/.env.production HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.16) Gecko\/20080716 (Gentoo) Galeon\/2.0.6",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid\/.env.production",
"evidence_snippet": "GET \/sendgrid\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.16)",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:07 UTC
TCP
8260 · HTTP
Flood / DDoS
http flood · via HTTP:8260 · (tentative d'exploit) · → /.sendgrid.env
Élevée
Moyen · 54
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /.sendgrid.env UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
net_flood
Cible HTTP
GET
/.sendgrid.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/.sendgrid.env
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /.sendgrid.env HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /.sendgrid.env HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like
Requête brute (extrait)
GET /.sendgrid.env HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "env",
"http_ua_hash": "5f54e573b05bff14b77d1814d3bb5eb9b4150213",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "8f07a946eac55a0d93410b891e5fe6efec058843",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 237,
"payload_entropy": 5.446778655257934,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 60,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 54,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "07988f3309d64461ad8ab093944f0a2f453f1c9a",
"event_fingerprint": "5e2f96757e04fdf08e17af805254ee956aefa4f4",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "29bf1f4d0981ae0108cf486395724145",
"payload_hash": "0f4f61ae7b35c54826408beafc7aa078",
"path_pattern_hash": "4d50e820d719289a3d1db022acb55ec6"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/.sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like ",
"method": "GET",
"path": "\/.sendgrid.env",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/71.0.3578.98 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/.sendgrid.env HTTP\/1.1",
"request_sample": "GET \/.sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/71.0.3578.98 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/.sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like",
"evidence": {
"method": "GET",
"path": "\/.sendgrid.env",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/71.0.3578.98 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/.sendgrid.env HTTP\/1.1",
"request_sample": "GET \/.sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/71.0.3578.98 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/.sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c0471cdf794d87b2ecfbf1c73454a4b901649fa2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.sendgrid.env",
"request_line": "GET \/.sendgrid.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/71.0.3578.98 Safari\/537.36",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like",
"attack_vector": "http flood \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.sendgrid.env",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.sendgrid.env",
"request_line": "GET \/.sendgrid.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/71.0.3578.98 Safari\/537.36",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.sendgrid.env",
"evidence_snippet": "GET \/.sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:07 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /services/api/.env
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /services/api/.env UA Mozilla/5.0 (iPad; CPU OS 13_0 like Mac OS X) AppleWebKit/605.1…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/services/api/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/services/api/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /services/api/.env HTTP/1.1
User-Agent
Mozilla/5.0 (iPad; CPU OS 13_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/79.0.259819395 Mobile/17A5556d Safari/604.1
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /services/api/.env HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (iPad; CPU OS 13_0 like Mac OS X) AppleWebKit/60
Requête brute (extrait)
GET /services/api/.env HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (iPad; CPU OS 13_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/79.0.259819395 Mobile/17A5556d Safari/604.1 Accept-Charset: utf-8 Accept-Encoding: gzip Connec
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "env",
"http_ua_hash": "9437cba28d03b8e367f23e3163029fd837235870",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "450e32f1680bf647be59805b14bbd52061e00349",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 271,
"payload_entropy": 5.420082622126594,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "0a29d72c394fcba0c14da0678f1848da05a5a5c6",
"event_fingerprint": "d375e4ea6994faf2159bf6d362e0a6256b80c0d2",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9ceb6144297d4f6896850fa4a6c56253",
"payload_hash": "0fe6367b2e1c17ca722c869a12ab0de5",
"path_pattern_hash": "9a476469205a3b7d9994ebc8d35d13e6"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/services\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 13_0 like Mac OS X) AppleWebKit\/60",
"method": "GET",
"path": "\/services\/api\/.env",
"user_agent": "Mozilla\/5.0 (iPad; CPU OS 13_0 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) GSA\/79.0.259819395 Mobile\/17A5556d Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/services\/api\/.env HTTP\/1.1",
"request_sample": "GET \/services\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 13_0 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) GSA\/79.0.259819395 Mobile\/17A5556d Safari\/604.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnec",
"payload_snippet": "GET \/services\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 13_0 like Mac OS X) AppleWebKit\/60",
"evidence": {
"method": "GET",
"path": "\/services\/api\/.env",
"user_agent": "Mozilla\/5.0 (iPad; CPU OS 13_0 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) GSA\/79.0.259819395 Mobile\/17A5556d Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/services\/api\/.env HTTP\/1.1",
"request_sample": "GET \/services\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 13_0 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) GSA\/79.0.259819395 Mobile\/17A5556d Safari\/604.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnec",
"payload_snippet": "GET \/services\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 13_0 like Mac OS X) AppleWebKit\/60",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "caad93b603a032866c2d7f07e7374be30a2384ed",
"protocol_details": {
"http_method": "GET",
"http_path": "\/services\/api\/.env",
"request_line": "GET \/services\/api\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPad; CPU OS 13_0 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) GSA\/79.0.259819395 Mobile\/17A555\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/services\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 13_0 like Mac OS X) AppleWebKit\/60",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/services\/api\/.env",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/services\/api\/.env",
"request_line": "GET \/services\/api\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPad; CPU OS 13_0 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) GSA\/79.0.259819395 Mobile\/17A555\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/services\/api\/.env",
"evidence_snippet": "GET \/services\/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 13_0 like Mac OS X) AppleWebKit\/60",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:07 UTC
TCP
8260 · HTTP
Flood / DDoS
http flood · via HTTP:8260 · (tentative d'exploit) · → /api/sendgrid.env
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /api/sendgrid.env UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950600:k8s-api
Cible HTTP
GET
/api/sendgrid.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/api/sendgrid.env
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /api/sendgrid.env HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Règles WAF
rce-0
nosqli-3
k8s-api
Payload (extrait)
GET /api/sendgrid.env HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, li
Requête brute (extrait)
GET /api/sendgrid.env HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "390b16722b73cf7ae62607c2f6523ed529003141",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "8149e0a81645028a99dab3a9f8706cae00eb175a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 241,
"payload_entropy": 5.46246008152067,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "d2faf6cd23cd19443ce0a9639143bdbb13ec22aa",
"event_fingerprint": "93906a8573300b1aa6be58dd082124b0072b6d25",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "be523e249f7fe67610072e380c27b10f",
"payload_hash": "1b30d628cae1150ccbffeda56b768130",
"path_pattern_hash": "bd5f833bf1b56cd8bb63ce4b1b4efaea"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/api\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, li",
"method": "GET",
"path": "\/api\/sendgrid.env",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.169 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"k8s-api"
],
"request_line": "GET \/api\/sendgrid.env HTTP\/1.1",
"request_sample": "GET \/api\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.169 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/api\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, li",
"evidence": {
"method": "GET",
"path": "\/api\/sendgrid.env",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.169 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"k8s-api"
],
"request_line": "GET \/api\/sendgrid.env HTTP\/1.1",
"request_sample": "GET \/api\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.169 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/api\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, li",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0f754cdfabc61841fadb0edd6582dd8130734cb0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/sendgrid.env",
"request_line": "GET \/api\/sendgrid.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.169 Safari\/537.36",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, li",
"attack_vector": "http flood \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/sendgrid.env",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/sendgrid.env",
"request_line": "GET \/api\/sendgrid.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.169 Safari\/537.36",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/sendgrid.env",
"evidence_snippet": "GET \/api\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, li",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api",
"http_probe_api",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:07 UTC
TCP
8260 · HTTP
Flood / DDoS
http flood · via HTTP:8260 · (tentative d'exploit) · → /email/sendgrid.env
Élevée
Moyen · 62
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /email/sendgrid.env UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/535.…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/email/sendgrid.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/email/sendgrid.env
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 62
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /email/sendgrid.env HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.36 Safari/535.7
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /email/sendgrid.env HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/
Requête brute (extrait)
GET /email/sendgrid.env HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.36 Safari/535.7 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "a9c9131f21bbd498611e10f71331c7dd5e9f7d05",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "7765a13ca36d03ce5c3bb95d98b761f9bdfc5359",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 254,
"payload_entropy": 5.40976787951467,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 62,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "c640df7b65b38add5a59a4ed5e54755b606ed5d8",
"event_fingerprint": "dcfa9f013afd0cf43f87a5206413ca9ddfe2f822",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "171b677823d70df4d8448ff04ae83405",
"payload_hash": "2b19a56d4d22b1f1f4b02aa299d6e4a0",
"path_pattern_hash": "fa9fcbdbb4fa67e9ab4f6eaf7971e782"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 62
},
"payload_preview": "GET \/email\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit\/",
"method": "GET",
"path": "\/email\/sendgrid.env",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit\/535.7 (KHTML, like Gecko) Chrome\/16.0.912.36 Safari\/535.7",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/email\/sendgrid.env HTTP\/1.1",
"request_sample": "GET \/email\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit\/535.7 (KHTML, like Gecko) Chrome\/16.0.912.36 Safari\/535.7\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/email\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit\/",
"evidence": {
"method": "GET",
"path": "\/email\/sendgrid.env",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit\/535.7 (KHTML, like Gecko) Chrome\/16.0.912.36 Safari\/535.7",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/email\/sendgrid.env HTTP\/1.1",
"request_sample": "GET \/email\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit\/535.7 (KHTML, like Gecko) Chrome\/16.0.912.36 Safari\/535.7\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/email\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit\/",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "15f240114f8b659de70dc7d469ee9e65b9d8bcd5",
"protocol_details": {
"http_method": "GET",
"http_path": "\/email\/sendgrid.env",
"request_line": "GET \/email\/sendgrid.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit\/535.7 (KHTML, like Gecko) Chrome\/16.0.912.36 Safari\/535.7",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/email\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit\/",
"attack_vector": "http flood \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/email\/sendgrid.env",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 62,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/email\/sendgrid.env",
"request_line": "GET \/email\/sendgrid.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit\/535.7 (KHTML, like Gecko) Chrome\/16.0.912.36 Safari\/535.7",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/email\/sendgrid.env",
"evidence_snippet": "GET \/email\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit\/",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:07 UTC
TCP
8260 · HTTP
Flood / DDoS
http flood · via HTTP:8260 · (tentative d'exploit) · → /backend/sendgrid.env
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /backend/sendgrid.env UA Mozilla/5.0 (OS/2; Warp 4.5; rv:45.0) Gecko/20100101 Firefox/45…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/backend/sendgrid.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/backend/sendgrid.env
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /backend/sendgrid.env HTTP/1.1
User-Agent
Mozilla/5.0 (OS/2; Warp 4.5; rv:45.0) Gecko/20100101 Firefox/45.0 SeaMonkey/2.42.9esr
Règles WAF
lfi-14
rce-0
nosqli-3
Payload (extrait)
GET /backend/sendgrid.env HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (OS/2; Warp 4.5; rv:45.0) Gecko/20100101 Fire
Requête brute (extrait)
GET /backend/sendgrid.env HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (OS/2; Warp 4.5; rv:45.0) Gecko/20100101 Firefox/45.0 SeaMonkey/2.42.9esr Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "fbfeb061a17a67387fddf78e72d6aecd0ca45bb9",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "6ca5cdbc93351479900cbb16227fdccd897d6239",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 225,
"payload_entropy": 5.324192578528656,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 68,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "1309bfdfa719b83df0ca0a5bb0864b0f54d51c40",
"event_fingerprint": "9543fa6fcf5f6f8781a86f67b870b9ff8a4b6cbe",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6bf7c869476b4b782705baafb658da2d",
"payload_hash": "4e0e01931fd2f9ab082eac40bf9ba349",
"path_pattern_hash": "7e30bd8e2fce0a25f9e4a2967db75cb4"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/backend\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (OS\/2; Warp 4.5; rv:45.0) Gecko\/20100101 Fire",
"method": "GET",
"path": "\/backend\/sendgrid.env",
"user_agent": "Mozilla\/5.0 (OS\/2; Warp 4.5; rv:45.0) Gecko\/20100101 Firefox\/45.0 SeaMonkey\/2.42.9esr",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backend\/sendgrid.env HTTP\/1.1",
"request_sample": "GET \/backend\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (OS\/2; Warp 4.5; rv:45.0) Gecko\/20100101 Firefox\/45.0 SeaMonkey\/2.42.9esr\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/backend\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (OS\/2; Warp 4.5; rv:45.0) Gecko\/20100101 Fire",
"evidence": {
"method": "GET",
"path": "\/backend\/sendgrid.env",
"user_agent": "Mozilla\/5.0 (OS\/2; Warp 4.5; rv:45.0) Gecko\/20100101 Firefox\/45.0 SeaMonkey\/2.42.9esr",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backend\/sendgrid.env HTTP\/1.1",
"request_sample": "GET \/backend\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (OS\/2; Warp 4.5; rv:45.0) Gecko\/20100101 Firefox\/45.0 SeaMonkey\/2.42.9esr\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/backend\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (OS\/2; Warp 4.5; rv:45.0) Gecko\/20100101 Fire",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c5487ca07bd761cdac8684487fd9673e02799be8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/sendgrid.env",
"request_line": "GET \/backend\/sendgrid.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (OS\/2; Warp 4.5; rv:45.0) Gecko\/20100101 Firefox\/45.0 SeaMonkey\/2.42.9esr",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (OS\/2; Warp 4.5; rv:45.0) Gecko\/20100101 Fire",
"attack_vector": "http flood \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/sendgrid.env",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/sendgrid.env",
"request_line": "GET \/backend\/sendgrid.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (OS\/2; Warp 4.5; rv:45.0) Gecko\/20100101 Firefox\/45.0 SeaMonkey\/2.42.9esr",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/sendgrid.env",
"evidence_snippet": "GET \/backend\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (OS\/2; Warp 4.5; rv:45.0) Gecko\/20100101 Fire",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:07 UTC
TCP
8260 · HTTP
Flood / DDoS
http flood · via HTTP:8260 · (tentative d'exploit) · → /mailer/sendgrid.env
Élevée
Moyen · 62
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /mailer/sendgrid.env UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/mailer/sendgrid.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/mailer/sendgrid.env
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 62
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /mailer/sendgrid.env HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.166 Safari/537.36 OPR/20.0.1396.73172
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /mailer/sendgrid.env HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML,
Requête brute (extrait)
GET /mailer/sendgrid.env HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.166 Safari/537.36 OPR/20.0.1396.73172 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: c
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "382da75523c223dfbcdd0e09421bce57344e47f9",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "0d804ea4366c582b0f223f08078e10e564e8a42a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 264,
"payload_entropy": 5.460013794808969,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 62,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "c640df7b65b38add5a59a4ed5e54755b606ed5d8",
"event_fingerprint": "ad49f514c5027df03e91419f8cbe3f2d75ac7d9a",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6bbabc1122a148f3bcd19efa6fcb88b6",
"payload_hash": "be72ec85035e8a1458541bb965d16346",
"path_pattern_hash": "66c1a617012ac9022dbc5b268897d59c"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 62
},
"payload_preview": "GET \/mailer\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML,",
"method": "GET",
"path": "\/mailer\/sendgrid.env",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/33.0.1750.166 Safari\/537.36 OPR\/20.0.1396.73172",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/mailer\/sendgrid.env HTTP\/1.1",
"request_sample": "GET \/mailer\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/33.0.1750.166 Safari\/537.36 OPR\/20.0.1396.73172\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: c",
"payload_snippet": "GET \/mailer\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML,",
"evidence": {
"method": "GET",
"path": "\/mailer\/sendgrid.env",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/33.0.1750.166 Safari\/537.36 OPR\/20.0.1396.73172",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/mailer\/sendgrid.env HTTP\/1.1",
"request_sample": "GET \/mailer\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/33.0.1750.166 Safari\/537.36 OPR\/20.0.1396.73172\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: c",
"payload_snippet": "GET \/mailer\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML,",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e79d1d00734a7038e145a4094f38737e677f25c3",
"protocol_details": {
"http_method": "GET",
"http_path": "\/mailer\/sendgrid.env",
"request_line": "GET \/mailer\/sendgrid.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/33.0.1750.166 Safari\/537.36 OPR\/20.0.1396\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/mailer\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML,",
"attack_vector": "http flood \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mailer\/sendgrid.env",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 62,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/mailer\/sendgrid.env",
"request_line": "GET \/mailer\/sendgrid.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/33.0.1750.166 Safari\/537.36 OPR\/20.0.1396\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mailer\/sendgrid.env",
"evidence_snippet": "GET \/mailer\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML,",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:07 UTC
TCP
8260 · HTTP
Flood / DDoS
http flood · via HTTP:8260 · (tentative d'exploit) · → /mail/sendgrid.env
Élevée
Moyen · 63
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /mail/sendgrid.env UA Mozilla/4.0 (compatible; MSIE 5.0; Series80/2.0 Nokia9500/4.51 …
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_probe_mail
Cible HTTP
GET
/mail/sendgrid.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/mail/sendgrid.env
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 63
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /mail/sendgrid.env HTTP/1.1
User-Agent
Mozilla/4.0 (compatible; MSIE 5.0; Series80/2.0 Nokia9500/4.51 Profile/MIDP-2.0 Configuration/CLDC-1.1)
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /mail/sendgrid.env HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Series80/2.0 Nokia9500/4.
Requête brute (extrait)
GET /mail/sendgrid.env HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Series80/2.0 Nokia9500/4.51 Profile/MIDP-2.0 Configuration/CLDC-1.1) Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "ba8a59a16daa512ffbf0990657e962697cf1fa7d",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "918fb0707c3047f4a464183e84e60c7ef822770a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 240,
"payload_entropy": 5.353564805126441,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 63,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cd0580a55656a54f4e6b4c2c087dd5de6788b46c",
"event_fingerprint": "cd7000e04c46bf868d002c7e7dea2ee7afd22ba5",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "d43b4ceb10541234c2eba8a9d9fde57b",
"payload_hash": "8170181ff89484c64d4793fda978f718",
"path_pattern_hash": "b9496c7b6aaeb3d017c2f794092f550b"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "GET \/mail\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 5.0; Series80\/2.0 Nokia9500\/4.",
"method": "GET",
"path": "\/mail\/sendgrid.env",
"user_agent": "Mozilla\/4.0 (compatible; MSIE 5.0; Series80\/2.0 Nokia9500\/4.51 Profile\/MIDP-2.0 Configuration\/CLDC-1.1)",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/mail\/sendgrid.env HTTP\/1.1",
"request_sample": "GET \/mail\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 5.0; Series80\/2.0 Nokia9500\/4.51 Profile\/MIDP-2.0 Configuration\/CLDC-1.1)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/mail\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 5.0; Series80\/2.0 Nokia9500\/4.",
"evidence": {
"method": "GET",
"path": "\/mail\/sendgrid.env",
"user_agent": "Mozilla\/4.0 (compatible; MSIE 5.0; Series80\/2.0 Nokia9500\/4.51 Profile\/MIDP-2.0 Configuration\/CLDC-1.1)",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/mail\/sendgrid.env HTTP\/1.1",
"request_sample": "GET \/mail\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 5.0; Series80\/2.0 Nokia9500\/4.51 Profile\/MIDP-2.0 Configuration\/CLDC-1.1)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/mail\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 5.0; Series80\/2.0 Nokia9500\/4.",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1349498aed36308f7fee3f5aa70999ee6819f129",
"protocol_details": {
"http_method": "GET",
"http_path": "\/mail\/sendgrid.env",
"request_line": "GET \/mail\/sendgrid.env HTTP\/1.1",
"http_user_agent": "Mozilla\/4.0 (compatible; MSIE 5.0; Series80\/2.0 Nokia9500\/4.51 Profile\/MIDP-2.0 Configuration\/CLDC-1.1)",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/mail\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 5.0; Series80\/2.0 Nokia9500\/4.",
"attack_vector": "http flood \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mail\/sendgrid.env",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/mail\/sendgrid.env",
"request_line": "GET \/mail\/sendgrid.env HTTP\/1.1",
"http_user_agent": "Mozilla\/4.0 (compatible; MSIE 5.0; Series80\/2.0 Nokia9500\/4.51 Profile\/MIDP-2.0 Configuration\/CLDC-1.1)",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mail\/sendgrid.env",
"evidence_snippet": "GET \/mail\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 5.0; Series80\/2.0 Nokia9500\/4.",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_mail",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:06 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /backend/.env.backup
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /backend/.env.backup UA Mozilla/5.0 (Linux; Android 7.1.1; 1607-A01 Build/NMF26F; wv) A…
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950086:sqli-21
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/backend/.env.backup
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/backend/.env.backup
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « sqli-21 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /backend/.env.backup HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 7.1.1; 1607-A01 Build/NMF26F; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/66.0.3359.126 MQQBrowser/6.2 TBS/044807 Mobile Safari/537.36 MMWEBID/2867 Micro…
Règles WAF
sqli-21
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /backend/.env.backup HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (Linux; Android 7.1.1; 1607-A01 Build/NMF26F;
Requête brute (extrait)
GET /backend/.env.backup HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (Linux; Android 7.1.1; 1607-A01 Build/NMF26F; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/66.0.3359.126 MQQBrowser/6.2 TBS/044807 Mobile Safari/537.36 MMWEB
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "backup",
"http_ua_hash": "67dcbcdcdd0c4e7afb7c713349a6bcc66acc6a39",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "010b38f2c3ba3880210fba1c683062ead6b6ee06",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 412,
"payload_entropy": 5.566791197407927,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "d5b6fceace0685332668f557d66ecaf0e4176bd0",
"event_fingerprint": "a14ffc93e8c192ec0f0e0024ca41fc06c340d710",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab sqli-21 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8dbb105922a5e1a254eb9fff2d71aa4f",
"payload_hash": "15904f97c9ad9c6e4725757bda1e6445",
"path_pattern_hash": "d21da08f9b6364ea0d2550ff45214b03"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/backend\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.1; 1607-A01 Build\/NMF26F; ",
"method": "GET",
"path": "\/backend\/.env.backup",
"user_agent": "Mozilla\/5.0 (Linux; Android 7.1.1; 1607-A01 Build\/NMF26F; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/66.0.3359.126 MQQBrowser\/6.2 TBS\/044807 Mobile Safari\/537.36 MMWEBID\/2867 MicroMessenger\/7.0.6.1460(0x27000634) Process\/tools NetType\/W\u2026",
"waf_tags": [
"950086:sqli-21",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"sqli-21",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/backend\/.env.backup HTTP\/1.1",
"request_sample": "GET \/backend\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.1; 1607-A01 Build\/NMF26F; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/66.0.3359.126 MQQBrowser\/6.2 TBS\/044807 Mobile Safari\/537.36 MMWEB",
"payload_snippet": "GET \/backend\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.1; 1607-A01 Build\/NMF26F;",
"evidence": {
"method": "GET",
"path": "\/backend\/.env.backup",
"user_agent": "Mozilla\/5.0 (Linux; Android 7.1.1; 1607-A01 Build\/NMF26F; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/66.0.3359.126 MQQBrowser\/6.2 TBS\/044807 Mobile Safari\/537.36 MMWEBID\/2867 MicroMessenger\/7.0.6.1460(0x27000634) Process\/tools NetType\/W\u2026",
"waf_tags": [
"950086:sqli-21",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"sqli-21",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/backend\/.env.backup HTTP\/1.1",
"request_sample": "GET \/backend\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.1; 1607-A01 Build\/NMF26F; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/66.0.3359.126 MQQBrowser\/6.2 TBS\/044807 Mobile Safari\/537.36 MMWEB",
"payload_snippet": "GET \/backend\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.1; 1607-A01 Build\/NMF26F;",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab sqli-21 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1b6e2b6fb59c0f1f41738745218092d190502fc3",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/.env.backup",
"request_line": "GET \/backend\/.env.backup HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 7.1.1; 1607-A01 Build\/NMF26F; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.1; 1607-A01 Build\/NMF26F;",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/.env.backup",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab sqli-21 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab sqli-21 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/.env.backup",
"request_line": "GET \/backend\/.env.backup HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 7.1.1; 1607-A01 Build\/NMF26F; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/.env.backup",
"evidence_snippet": "GET \/backend\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.1; 1607-A01 Build\/NMF26F;",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950086:sqli-21",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:06 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /backend/.env.production
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /backend/.env.production UA Googlebot/2.1 ( http://www.googlebot.com/bot.html)
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950406:ssrf-3
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/backend/.env.production
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/backend/.env.production
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « ssrf-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /backend/.env.production HTTP/1.1
User-Agent
Googlebot/2.1 ( http://www.googlebot.com/bot.html)
Règles WAF
ssrf-3
nosqli-3
leak-1
Payload (extrait)
GET /backend/.env.production HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Googlebot/2.1 ( http://www.googlebot.com/bot.html)
Ac
Requête brute (extrait)
GET /backend/.env.production HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Googlebot/2.1 ( http://www.googlebot.com/bot.html) Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "production",
"http_ua_hash": "1592e0be67ba82f6dd4bb79b36135037a8c54419",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "f5bb9f02b8945472030d827baea0ca721346631c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 193,
"payload_entropy": 5.095168807281027,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "b1abea76dff342e8642b90c530f5686c192f8db6",
"event_fingerprint": "2bfce743bcee69c8787374bbd4658d78321e8832",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "d611ac310fd1490c913567bde0679332",
"payload_hash": "f75337d80b64f33876bb218ec93db3e3",
"path_pattern_hash": "36d1a8d01ff9d9e501d856bd9686d325"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/backend\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Googlebot\/2.1 ( http:\/\/www.googlebot.com\/bot.html)\r\nAc",
"method": "GET",
"path": "\/backend\/.env.production",
"user_agent": "Googlebot\/2.1 ( http:\/\/www.googlebot.com\/bot.html)",
"waf_tags": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/backend\/.env.production HTTP\/1.1",
"request_sample": "GET \/backend\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Googlebot\/2.1 ( http:\/\/www.googlebot.com\/bot.html)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/backend\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Googlebot\/2.1 ( http:\/\/www.googlebot.com\/bot.html)\r\nAc",
"evidence": {
"method": "GET",
"path": "\/backend\/.env.production",
"user_agent": "Googlebot\/2.1 ( http:\/\/www.googlebot.com\/bot.html)",
"waf_tags": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/backend\/.env.production HTTP\/1.1",
"request_sample": "GET \/backend\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Googlebot\/2.1 ( http:\/\/www.googlebot.com\/bot.html)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/backend\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Googlebot\/2.1 ( http:\/\/www.googlebot.com\/bot.html)\r\nAc",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7d09b290da33594be0eb6c628591591b42f07b03",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/.env.production",
"request_line": "GET \/backend\/.env.production HTTP\/1.1",
"http_user_agent": "Googlebot\/2.1 ( http:\/\/www.googlebot.com\/bot.html)",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Googlebot\/2.1 ( http:\/\/www.googlebot.com\/bot.html)\r\nAc",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/.env.production",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/.env.production",
"request_line": "GET \/backend\/.env.production HTTP\/1.1",
"http_user_agent": "Googlebot\/2.1 ( http:\/\/www.googlebot.com\/bot.html)",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/.env.production",
"evidence_snippet": "GET \/backend\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Googlebot\/2.1 ( http:\/\/www.googlebot.com\/bot.html)\r\nAc",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:06 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /backend/.env.local
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /backend/.env.local UA Mozilla/5.0 (Macintosh; Intel Mac OS X 1083) AppleWebKit/537.36…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/backend/.env.local
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/backend/.env.local
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /backend/.env.local HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 1083) AppleWebKit/537.36 (KHTML like Gecko) Chrome/28.0.1469.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /backend/.env.local HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 1083) AppleWebKit/53
Requête brute (extrait)
GET /backend/.env.local HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 1083) AppleWebKit/537.36 (KHTML like Gecko) Chrome/28.0.1469.0 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "local",
"http_ua_hash": "d50c842e700f4367064cfac05a368dc3fb40ac64",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "7a997ecf8c7c3ade11101024aba12e58dee560af",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 253,
"payload_entropy": 5.372941502118656,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "0a29d72c394fcba0c14da0678f1848da05a5a5c6",
"event_fingerprint": "392c95c06deea921be912341baeccc8713fb1aec",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "d30310faf9794f7d6f2ef6a28f69ef93",
"payload_hash": "73f42037bc7512d3d2980e2d8be47270",
"path_pattern_hash": "6e2a711f7323df4e4b7b37b3c8fb7ec7"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/backend\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 1083) AppleWebKit\/53",
"method": "GET",
"path": "\/backend\/.env.local",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 1083) AppleWebKit\/537.36 (KHTML like Gecko) Chrome\/28.0.1469.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/backend\/.env.local HTTP\/1.1",
"request_sample": "GET \/backend\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 1083) AppleWebKit\/537.36 (KHTML like Gecko) Chrome\/28.0.1469.0 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/backend\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 1083) AppleWebKit\/53",
"evidence": {
"method": "GET",
"path": "\/backend\/.env.local",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 1083) AppleWebKit\/537.36 (KHTML like Gecko) Chrome\/28.0.1469.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/backend\/.env.local HTTP\/1.1",
"request_sample": "GET \/backend\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 1083) AppleWebKit\/537.36 (KHTML like Gecko) Chrome\/28.0.1469.0 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/backend\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 1083) AppleWebKit\/53",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0b8e0fdf75e7fc853b939e46abb92609411cc874",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/.env.local",
"request_line": "GET \/backend\/.env.local HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 1083) AppleWebKit\/537.36 (KHTML like Gecko) Chrome\/28.0.1469.0 Safari\/537.36",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 1083) AppleWebKit\/53",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/.env.local",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/.env.local",
"request_line": "GET \/backend\/.env.local HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 1083) AppleWebKit\/537.36 (KHTML like Gecko) Chrome\/28.0.1469.0 Safari\/537.36",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/.env.local",
"evidence_snippet": "GET \/backend\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 1083) AppleWebKit\/53",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:06 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /backend/.env.bak
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /backend/.env.bak UA Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
35
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/backend/.env.bak
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/backend/.env.bak
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /backend/.env.bak HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.170 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
leak-8
Payload (extrait)
GET /backend/.env.bak HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (
Requête brute (extrait)
GET /backend/.env.bak HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.170 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "bak",
"http_ua_hash": "89ad0029b2143d93cc8b33793d4548b188b94014",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "634ed927b1f303dd63cc0a7dc5f7e8b5a6847ee7",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 250,
"payload_entropy": 5.424787084590055,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 9,
"anomaly_count": 0,
"campaign_key": "965bb0aa7e1ea67a9152365df31ae391073a8436",
"event_fingerprint": "2df2b1595b3ac5de32ed6f9ab013ec59ee50b795",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3cb77f1b08fff0e3aa55b35e3dcb3934",
"payload_hash": "ecad167fab44b2696b4f71a1ffe1e09e",
"path_pattern_hash": "6679bce94c041ed02cf99c5001176812"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/backend\/.env.bak HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (",
"method": "GET",
"path": "\/backend\/.env.bak",
"user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/66.0.3359.170 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1",
"leak-8"
],
"request_line": "GET \/backend\/.env.bak HTTP\/1.1",
"request_sample": "GET \/backend\/.env.bak HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/66.0.3359.170 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/backend\/.env.bak HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (",
"evidence": {
"method": "GET",
"path": "\/backend\/.env.bak",
"user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/66.0.3359.170 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1",
"leak-8"
],
"request_line": "GET \/backend\/.env.bak HTTP\/1.1",
"request_sample": "GET \/backend\/.env.bak HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/66.0.3359.170 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/backend\/.env.bak HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "50dd32d03ca179c198a116e9909e9e3fd2e66c6d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/.env.bak",
"request_line": "GET \/backend\/.env.bak HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/66.0.3359.170 Safari\/537.36",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend\/.env.bak HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/.env.bak",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/.env.bak",
"request_line": "GET \/backend\/.env.bak HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/66.0.3359.170 Safari\/537.36",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/.env.bak",
"evidence_snippet": "GET \/backend\/.env.bak HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8",
"http_backup_file_scan",
"http_backup_path",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:06 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /frontend/.env.backup
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /frontend/.env.backup UA Mozilla/5.0 (Linux; Android 5.1.1; A37f) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/frontend/.env.backup
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/frontend/.env.backup
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /frontend/.env.backup HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 5.1.1; A37f) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /frontend/.env.backup HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; A37f) AppleWebKit/537.
Requête brute (extrait)
GET /frontend/.env.backup HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; A37f) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: clos
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "backup",
"http_ua_hash": "a0e58f0536f0d6d039ac38ea1afcfc639f14c579",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "041ec2294a1481dc3081607b44ac63096bc8be9b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 261,
"payload_entropy": 5.3822653673705165,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "0a29d72c394fcba0c14da0678f1848da05a5a5c6",
"event_fingerprint": "e70524bb21ee9a9c539c8fb2757a1673da91a7b1",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1432cb10f0aa4d0ad703f717b7fe97ee",
"payload_hash": "79b8fe5c0721c244b5467a5e71591c0c",
"path_pattern_hash": "63098b77ef1e7ed1f9ff56d3ae7886f5"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/frontend\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1.1; A37f) AppleWebKit\/537.",
"method": "GET",
"path": "\/frontend\/.env.backup",
"user_agent": "Mozilla\/5.0 (Linux; Android 5.1.1; A37f) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env.backup HTTP\/1.1",
"request_sample": "GET \/frontend\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1.1; A37f) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: clos",
"payload_snippet": "GET \/frontend\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1.1; A37f) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/frontend\/.env.backup",
"user_agent": "Mozilla\/5.0 (Linux; Android 5.1.1; A37f) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env.backup HTTP\/1.1",
"request_sample": "GET \/frontend\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1.1; A37f) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: clos",
"payload_snippet": "GET \/frontend\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1.1; A37f) AppleWebKit\/537.",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8d175878dc95e90b6b016465bb9eb4694344458d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/frontend\/.env.backup",
"request_line": "GET \/frontend\/.env.backup HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 5.1.1; A37f) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/frontend\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1.1; A37f) AppleWebKit\/537.",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/frontend\/.env.backup",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/frontend\/.env.backup",
"request_line": "GET \/frontend\/.env.backup HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 5.1.1; A37f) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/frontend\/.env.backup",
"evidence_snippet": "GET \/frontend\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1.1; A37f) AppleWebKit\/537.",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:06 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /frontend/.env
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /frontend/.env UA Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/frontend/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/frontend/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /frontend/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /frontend/.env HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHT
Requête brute (extrait)
GET /frontend/.env HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "75dd158f63f3555441991f55a9b8d3d0ceeddfa2",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "77987435bb3ae079ceddf1be0ca83f10bd79e60f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 247,
"payload_entropy": 5.400763600248704,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "0a29d72c394fcba0c14da0678f1848da05a5a5c6",
"event_fingerprint": "453076b77117a971b6f1295cec447f04bdddcee0",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c87ecf9ccfd16ff01ad71bb7f657f9c3",
"payload_hash": "700b40c548a3e468398ef33d8e4fedc0",
"path_pattern_hash": "2eb92b74c9200f7bfafce81d1b6d362c"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/frontend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHT",
"method": "GET",
"path": "\/frontend\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.121 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env HTTP\/1.1",
"request_sample": "GET \/frontend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.121 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/frontend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHT",
"evidence": {
"method": "GET",
"path": "\/frontend\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.121 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env HTTP\/1.1",
"request_sample": "GET \/frontend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.121 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/frontend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHT",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5b1eb90bdce8df4ade3dc1b16ab0221ef79ce5f0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/frontend\/.env",
"request_line": "GET \/frontend\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.121 Safari\/537.36",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/frontend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHT",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/frontend\/.env",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/frontend\/.env",
"request_line": "GET \/frontend\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.121 Safari\/537.36",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/frontend\/.env",
"evidence_snippet": "GET \/frontend\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHT",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:06 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /frontend/.env.prod
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /frontend/.env.prod UA Mozilla/5.0 (BlackBerry; U; BlackBerry 9800; en) AppleWebKit/53…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/frontend/.env.prod
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/frontend/.env.prod
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /frontend/.env.prod HTTP/1.1
User-Agent
Mozilla/5.0 (BlackBerry; U; BlackBerry 9800; en) AppleWebKit/534.1 (KHTML, Like Gecko) Version/6.0.0.141 Mobile Safari/534.1
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /frontend/.env.prod HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (BlackBerry; U; BlackBerry 9800; en) AppleWebKi
Requête brute (extrait)
GET /frontend/.env.prod HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (BlackBerry; U; BlackBerry 9800; en) AppleWebKit/534.1 (KHTML, Like Gecko) Version/6.0.0.141 Mobile Safari/534.1 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: cl
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "prod",
"http_ua_hash": "66cd03f586a4146c65bf2f176629d7c145b9f56d",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "cf3ece5c26ce77d1afb6b3a84469b6cc81aaf4e1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 263,
"payload_entropy": 5.368077695665836,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "0a29d72c394fcba0c14da0678f1848da05a5a5c6",
"event_fingerprint": "fce12e3a623fa7e56f2721312cbf816f5f9a2599",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6b0011d361889f521dd4c5b16413d8a8",
"payload_hash": "966dec34cad6bd64d7f03d4e954f9b0f",
"path_pattern_hash": "b602f165e7f6eb051e1d5630d1727616"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/frontend\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (BlackBerry; U; BlackBerry 9800; en) AppleWebKi",
"method": "GET",
"path": "\/frontend\/.env.prod",
"user_agent": "Mozilla\/5.0 (BlackBerry; U; BlackBerry 9800; en) AppleWebKit\/534.1 (KHTML, Like Gecko) Version\/6.0.0.141 Mobile Safari\/534.1",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env.prod HTTP\/1.1",
"request_sample": "GET \/frontend\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (BlackBerry; U; BlackBerry 9800; en) AppleWebKit\/534.1 (KHTML, Like Gecko) Version\/6.0.0.141 Mobile Safari\/534.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: cl",
"payload_snippet": "GET \/frontend\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (BlackBerry; U; BlackBerry 9800; en) AppleWebKi",
"evidence": {
"method": "GET",
"path": "\/frontend\/.env.prod",
"user_agent": "Mozilla\/5.0 (BlackBerry; U; BlackBerry 9800; en) AppleWebKit\/534.1 (KHTML, Like Gecko) Version\/6.0.0.141 Mobile Safari\/534.1",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env.prod HTTP\/1.1",
"request_sample": "GET \/frontend\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (BlackBerry; U; BlackBerry 9800; en) AppleWebKit\/534.1 (KHTML, Like Gecko) Version\/6.0.0.141 Mobile Safari\/534.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: cl",
"payload_snippet": "GET \/frontend\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (BlackBerry; U; BlackBerry 9800; en) AppleWebKi",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "55fe119bdffc500f09f261747dfad4cfc59f8c2d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/frontend\/.env.prod",
"request_line": "GET \/frontend\/.env.prod HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (BlackBerry; U; BlackBerry 9800; en) AppleWebKit\/534.1 (KHTML, Like Gecko) Version\/6.0.0.141 Mobile Safari\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/frontend\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (BlackBerry; U; BlackBerry 9800; en) AppleWebKi",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/frontend\/.env.prod",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/frontend\/.env.prod",
"request_line": "GET \/frontend\/.env.prod HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (BlackBerry; U; BlackBerry 9800; en) AppleWebKit\/534.1 (KHTML, Like Gecko) Version\/6.0.0.141 Mobile Safari\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/frontend\/.env.prod",
"evidence_snippet": "GET \/frontend\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (BlackBerry; U; BlackBerry 9800; en) AppleWebKi",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:06 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /frontend/.env.dev
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /frontend/.env.dev UA W3C_Validator/1.305.2.12 libwww-perl/5.64
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950468:nosqli-3
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/frontend/.env.dev
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/frontend/.env.dev
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /frontend/.env.dev HTTP/1.1
User-Agent
W3C_Validator/1.305.2.12 libwww-perl/5.64
Règles WAF
nosqli-3
leak-1
Payload (extrait)
GET /frontend/.env.dev HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: W3C_Validator/1.305.2.12 libwww-perl/5.64
Accept-Charset: u
Requête brute (extrait)
GET /frontend/.env.dev HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: W3C_Validator/1.305.2.12 libwww-perl/5.64 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "dev",
"http_ua_hash": "d63616c52d160fdbeb9f865a126e2f8880b03425",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "c038a771c7c9859031021bfbc55da91693d8463c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 178,
"payload_entropy": 5.19882566976729,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 88,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 88,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 64,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "dbc2891501a924466824c7d59be8cdf1faaa9faa",
"event_fingerprint": "037bd7f0867be9c719fb155a4c3476b5aa1bd505",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 88,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 64,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7cb164c04e2b1ff53a5497f5cfeaf9c3",
"payload_hash": "95533718031f0e078da1ff286b1d5d7c",
"path_pattern_hash": "0210417b51ca7f1ff86d34574422463e"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/frontend\/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: W3C_Validator\/1.305.2.12 libwww-perl\/5.64\r\nAccept-Charset: u",
"method": "GET",
"path": "\/frontend\/.env.dev",
"user_agent": "W3C_Validator\/1.305.2.12 libwww-perl\/5.64",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env.dev HTTP\/1.1",
"request_sample": "GET \/frontend\/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: W3C_Validator\/1.305.2.12 libwww-perl\/5.64\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/frontend\/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: W3C_Validator\/1.305.2.12 libwww-perl\/5.64\r\nAccept-Charset: u",
"evidence": {
"method": "GET",
"path": "\/frontend\/.env.dev",
"user_agent": "W3C_Validator\/1.305.2.12 libwww-perl\/5.64",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env.dev HTTP\/1.1",
"request_sample": "GET \/frontend\/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: W3C_Validator\/1.305.2.12 libwww-perl\/5.64\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/frontend\/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: W3C_Validator\/1.305.2.12 libwww-perl\/5.64\r\nAccept-Charset: u",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fda8939816ceb554b56e0737eecbc51f61ce5ead",
"protocol_details": {
"http_method": "GET",
"http_path": "\/frontend\/.env.dev",
"request_line": "GET \/frontend\/.env.dev HTTP\/1.1",
"http_user_agent": "W3C_Validator\/1.305.2.12 libwww-perl\/5.64",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/frontend\/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: W3C_Validator\/1.305.2.12 libwww-perl\/5.64\r\nAccept-Charset: u",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/frontend\/.env.dev",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 64,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/frontend\/.env.dev",
"request_line": "GET \/frontend\/.env.dev HTTP\/1.1",
"http_user_agent": "W3C_Validator\/1.305.2.12 libwww-perl\/5.64",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/frontend\/.env.dev",
"evidence_snippet": "GET \/frontend\/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: W3C_Validator\/1.305.2.12 libwww-perl\/5.64\r\nAccept-Charset: u",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"http_ua_suspicious",
"net_flood"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 84
}
14/06/2026 16:02:06 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /frontend/.env.staging
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /frontend/.env.staging UA Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/frontend/.env.staging
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/frontend/.env.staging
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /frontend/.env.staging HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /frontend/.env.staging HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537
Requête brute (extrait)
GET /frontend/.env.staging HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "staging",
"http_ua_hash": "75dd158f63f3555441991f55a9b8d3d0ceeddfa2",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "b9354afd7c7fbb8f226b6c5ad37595989c02511e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 255,
"payload_entropy": 5.3941396905090695,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "0a29d72c394fcba0c14da0678f1848da05a5a5c6",
"event_fingerprint": "92116514267b2f4b0e834bd38a8ad01e6f459242",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c87ecf9ccfd16ff01ad71bb7f657f9c3",
"payload_hash": "5be9ae6b3de346c6e7735978a2413164",
"path_pattern_hash": "d743fa13fb1b94912fe1841ecd591349"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/frontend\/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537",
"method": "GET",
"path": "\/frontend\/.env.staging",
"user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.121 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env.staging HTTP\/1.1",
"request_sample": "GET \/frontend\/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.121 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/frontend\/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537",
"evidence": {
"method": "GET",
"path": "\/frontend\/.env.staging",
"user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.121 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env.staging HTTP\/1.1",
"request_sample": "GET \/frontend\/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.121 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/frontend\/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a63d15e5c640745f31a8ed8c1ebd009fbb3ef750",
"protocol_details": {
"http_method": "GET",
"http_path": "\/frontend\/.env.staging",
"request_line": "GET \/frontend\/.env.staging HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.121 Safari\/537.36",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/frontend\/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/frontend\/.env.staging",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/frontend\/.env.staging",
"request_line": "GET \/frontend\/.env.staging HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.121 Safari\/537.36",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/frontend\/.env.staging",
"evidence_snippet": "GET \/frontend\/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:06 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /src/.env.local
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /src/.env.local UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit/537…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/src/.env.local
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/src/.env.local
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /src/.env.local HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /src/.env.local HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit/537
Requête brute (extrait)
GET /src/.env.local HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "local",
"http_ua_hash": "457c7c5b9f2f460a1cb79343b239e3eef144d242",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "e4304ce88152d59a50dc3020ea792863da65ad77",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 255,
"payload_entropy": 5.388832100197148,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "0a29d72c394fcba0c14da0678f1848da05a5a5c6",
"event_fingerprint": "45ca82eeb6158432a61cf4f4f99610f40dfb7a04",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6eecfacb9b0aa86f6ba2dd5fd372feb8",
"payload_hash": "a4681228c9e6519ce52179aba8254d7c",
"path_pattern_hash": "0ca29e8f6e861d700e912e83099b82f9"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/src\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit\/537",
"method": "GET",
"path": "\/src\/.env.local",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/src\/.env.local HTTP\/1.1",
"request_sample": "GET \/src\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/src\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit\/537",
"evidence": {
"method": "GET",
"path": "\/src\/.env.local",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/src\/.env.local HTTP\/1.1",
"request_sample": "GET \/src\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/src\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit\/537",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "db141cd47e49b780ea72b07f82f1c1688b49ccfc",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/.env.local",
"request_line": "GET \/src\/.env.local HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/src\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit\/537",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/.env.local",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/.env.local",
"request_line": "GET \/src\/.env.local HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/.env.local",
"evidence_snippet": "GET \/src\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit\/537",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:06 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /frontend/.env.production
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /frontend/.env.production UA Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML,…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/frontend/.env.production
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/frontend/.env.production
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /frontend/.env.production HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /frontend/.env.production HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.
Requête brute (extrait)
GET /frontend/.env.production HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "production",
"http_ua_hash": "749a1319cab828d342340bc9c1b00753b675ab09",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "d9a2c7e4bfc8a23ebeeaa1888ef5fa4be1e92ee6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 253,
"payload_entropy": 5.412605874711101,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "0a29d72c394fcba0c14da0678f1848da05a5a5c6",
"event_fingerprint": "4624b4b135caecac2e247065c0546435cf5b6c63",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "20cd15d87d129e9580cef71d6154eeaf",
"payload_hash": "8b94d3a59eb31f67c9d5f2e75ce73964",
"path_pattern_hash": "6f5e9dea5f57f4e72146c7e773e7255d"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/frontend\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.",
"method": "GET",
"path": "\/frontend\/.env.production",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/71.0.3578.98 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env.production HTTP\/1.1",
"request_sample": "GET \/frontend\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/71.0.3578.98 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/frontend\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/frontend\/.env.production",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/71.0.3578.98 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/frontend\/.env.production HTTP\/1.1",
"request_sample": "GET \/frontend\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/71.0.3578.98 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/frontend\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2a130b55e4dec96daf46f586a4020eb8f9540f82",
"protocol_details": {
"http_method": "GET",
"http_path": "\/frontend\/.env.production",
"request_line": "GET \/frontend\/.env.production HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/71.0.3578.98 Safari\/537.36",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/frontend\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/frontend\/.env.production",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/frontend\/.env.production",
"request_line": "GET \/frontend\/.env.production HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/71.0.3578.98 Safari\/537.36",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/frontend\/.env.production",
"evidence_snippet": "GET \/frontend\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:06 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /backend/.env.old
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /backend/.env.old UA SonyEricssonW660i/R6AD Browser/NetFront/3.3 Profile/MIDP-2.0 Co…
Émulateur
HTTP
WAF
28
Recommandation
Investiguer
Tags
950468:nosqli-3
950470:nosqli-3
950514:leak-1
950521:leak-8
Cible HTTP
GET
/backend/.env.old
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/backend/.env.old
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /backend/.env.old HTTP/1.1
User-Agent
SonyEricssonW660i/R6AD Browser/NetFront/3.3 Profile/MIDP-2.0 Configuration/CLDC-1.1
Règles WAF
nosqli-3
leak-1
leak-8
Payload (extrait)
GET /backend/.env.old HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: SonyEricssonW660i/R6AD Browser/NetFront/3.3 Profile/MIDP-2.0
Requête brute (extrait)
GET /backend/.env.old HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: SonyEricssonW660i/R6AD Browser/NetFront/3.3 Profile/MIDP-2.0 Configuration/CLDC-1.1 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "old",
"http_ua_hash": "9781410f7361383084aafa131a314a6e2c9192a7",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "1f4d8d4518e413ad6b5a41c5ce61d38167670e32",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 219,
"payload_entropy": 5.285837313387294,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "6402fbb489b46d7c6bdb0d6ede800c74c863184a",
"event_fingerprint": "1d074197f0dd6db058dd22a422bcd6ddde2c6bdb",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e593b348fc4f04da74d0e8a31a0a71c5",
"payload_hash": "bb26136e7b7c9fb770bb0d4ed2d29b15",
"path_pattern_hash": "253500a6a15b8bd3c8b0f4dfe71121e2"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/backend\/.env.old HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: SonyEricssonW660i\/R6AD Browser\/NetFront\/3.3 Profile\/MIDP-2.0 ",
"method": "GET",
"path": "\/backend\/.env.old",
"user_agent": "SonyEricssonW660i\/R6AD Browser\/NetFront\/3.3 Profile\/MIDP-2.0 Configuration\/CLDC-1.1",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8"
],
"waf_rule_names": [
"nosqli-3",
"leak-1",
"leak-8"
],
"request_line": "GET \/backend\/.env.old HTTP\/1.1",
"request_sample": "GET \/backend\/.env.old HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: SonyEricssonW660i\/R6AD Browser\/NetFront\/3.3 Profile\/MIDP-2.0 Configuration\/CLDC-1.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/backend\/.env.old HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: SonyEricssonW660i\/R6AD Browser\/NetFront\/3.3 Profile\/MIDP-2.0",
"evidence": {
"method": "GET",
"path": "\/backend\/.env.old",
"user_agent": "SonyEricssonW660i\/R6AD Browser\/NetFront\/3.3 Profile\/MIDP-2.0 Configuration\/CLDC-1.1",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8"
],
"waf_rule_names": [
"nosqli-3",
"leak-1",
"leak-8"
],
"request_line": "GET \/backend\/.env.old HTTP\/1.1",
"request_sample": "GET \/backend\/.env.old HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: SonyEricssonW660i\/R6AD Browser\/NetFront\/3.3 Profile\/MIDP-2.0 Configuration\/CLDC-1.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/backend\/.env.old HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: SonyEricssonW660i\/R6AD Browser\/NetFront\/3.3 Profile\/MIDP-2.0",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f50c3fb8211264ba81d6ee34dc572c0001e9705b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/.env.old",
"request_line": "GET \/backend\/.env.old HTTP\/1.1",
"http_user_agent": "SonyEricssonW660i\/R6AD Browser\/NetFront\/3.3 Profile\/MIDP-2.0 Configuration\/CLDC-1.1",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend\/.env.old HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: SonyEricssonW660i\/R6AD Browser\/NetFront\/3.3 Profile\/MIDP-2.0",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/.env.old",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/.env.old",
"request_line": "GET \/backend\/.env.old HTTP\/1.1",
"http_user_agent": "SonyEricssonW660i\/R6AD Browser\/NetFront\/3.3 Profile\/MIDP-2.0 Configuration\/CLDC-1.1",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/.env.old",
"evidence_snippet": "GET \/backend\/.env.old HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: SonyEricssonW660i\/R6AD Browser\/NetFront\/3.3 Profile\/MIDP-2.0",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8",
"http_backup_file_scan",
"http_backup_path",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:06 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /src/.env
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /src/.env UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/600…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/src/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/src/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /src/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/600.8.9 (KHTML, like Gecko) Maxthon/4.5.2
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /src/.env HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/600.8.9 (
Requête brute (extrait)
GET /src/.env HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/600.8.9 (KHTML, like Gecko) Maxthon/4.5.2 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "52c41d6db66cc82d7a1fb5e925bf4d21250a8390",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "0c533120cce5f9ceabf0223e76a6dc86fc19a74f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 229,
"payload_entropy": 5.368667507930642,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "0a29d72c394fcba0c14da0678f1848da05a5a5c6",
"event_fingerprint": "b2355892e49cbab27906d942496208e675791042",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c45b693282b46eeaf200125748363cb9",
"payload_hash": "4f6e82c139b967d8ac760b01ae1137ce",
"path_pattern_hash": "1be4509071ea53617b7e83d68c291bb4"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/src\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit\/600.8.9 (",
"method": "GET",
"path": "\/src\/.env",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit\/600.8.9 (KHTML, like Gecko) Maxthon\/4.5.2",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/src\/.env HTTP\/1.1",
"request_sample": "GET \/src\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit\/600.8.9 (KHTML, like Gecko) Maxthon\/4.5.2\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/src\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit\/600.8.9 (",
"evidence": {
"method": "GET",
"path": "\/src\/.env",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit\/600.8.9 (KHTML, like Gecko) Maxthon\/4.5.2",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/src\/.env HTTP\/1.1",
"request_sample": "GET \/src\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit\/600.8.9 (KHTML, like Gecko) Maxthon\/4.5.2\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/src\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit\/600.8.9 (",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "30fe41890fa6204570836440bcddbb067be66b8a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/.env",
"request_line": "GET \/src\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit\/600.8.9 (KHTML, like Gecko) Maxthon\/4.5.2",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/src\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit\/600.8.9 (",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/.env",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/.env",
"request_line": "GET \/src\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit\/600.8.9 (KHTML, like Gecko) Maxthon\/4.5.2",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/.env",
"evidence_snippet": "GET \/src\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit\/600.8.9 (",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:06 UTC
TCP
8260 · TLS
Sonde PostgreSQL
postgres probe · via TLS:8260 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8260
Chemin / cible
—
Service
TLS
Payload
� �9��c�� ��qۍ,�}z�=S��,=o�^:5 �x� ^:"�e_jx u��j&j ��� &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �9��c�� ��qۍ,�}z�=S��,=o�^:5 �x�
^:"�e_jx u��j&j
��� &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� �9��c�� ��qۍ,�}z�=S��,=o�^:5 �x� ^:"�e_jx u��j&j ��� &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ �#gQ�dE:mҒ���̨ܾ[������%��m
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.720690340013087,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "63078d6f18cf1751dc4fcf365472528190d837ea",
"event_fingerprint": "73e984194c8d37522e0e3314b145e12f5da46517",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "71995ca305120c0f90b7ca0f83af5841",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8260,
"service": "tls",
"service_name": "tls",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039\ufffd\ufffdc\u001b\ufffd\ufffd \ufffd\ufffdq\u06cd,\ufffd}z\ufffd=S\ufffd\ufffd,=o\u0004\ufffd^\u0015:\u00105 \u0001\ufffdx\ufffd\r^:\"\u0004\ufffd\u0013\u0015\u001ae_j\u0019\u0013\u0004x\u0000u\ufffd\ufffdj&j\r\ufffd\b\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039\ufffd\ufffdc\u001b\ufffd\ufffd \ufffd\ufffdq\u06cd,\ufffd}z\ufffd=S\ufffd\ufffd,=o\u0004\ufffd^\u0015:\u00105 \u0001\ufffdx\ufffd\r^:\"\u0004\ufffd\u0013\u0015\u001ae_j\u0019\u0013\u0004x\u0000u\ufffd\ufffdj&j\r\ufffd\b\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd#gQ\ufffddE:m\u0492\u0016\ufffd\ufffd\ufffd\u073e\u0328[\ufffd\ufffd\ufffd\ufffd\u0003\ufffd\u0012\ufffd%\ufffd\ufffdm",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039\ufffd\ufffdc\u001b\ufffd\ufffd \ufffd\ufffdq\u06cd,\ufffd}z\ufffd=S\ufffd\ufffd,=o\u0004\ufffd^\u0015:\u00105 \u0001\ufffdx\ufffd\r^:\"\u0004\ufffd\u0013\u0015\u001ae_j\u0019\u0013\u0004x\u0000u\ufffd\ufffdj&j\r\ufffd\b\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c4e434a4903922da26915ae44dfa60580b710228",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039\ufffd\ufffdc\u001b\ufffd\ufffd \ufffd\ufffdq\u06cd,\ufffd}z\ufffd=S\ufffd\ufffd,=o\u0004\ufffd^\u0015:\u00105 \u0001\ufffdx\ufffd\r^:\"\u0004\ufffd\u0013\u0015\u001ae_j\u0019\u0013\u0004x\u0000u\ufffd\ufffdj&j\r\ufffd\b\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8260,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd9\ufffd\ufffdc\ufffd\ufffd \ufffd\ufffdq\u06cd,\ufffd}z\ufffd=S\ufffd\ufffd,=o\ufffd^:5 \ufffdx\ufffd\r^:\"\ufffde_jxu\ufffd\ufffdj&j\r\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via TLS:8260 \u00b7 (sonde \/ probe)",
"target_port_label": "8260 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039\ufffd\ufffdc\u001b\ufffd\ufffd \ufffd\ufffdq\u06cd,\ufffd}z\ufffd=S\ufffd\ufffd,=o\u0004\ufffd^\u0015:\u00105 \u0001\ufffdx\ufffd\r^:\"\u0004\ufffd\u0013\u0015\u001ae_j\u0019\u0013\u0004x\u0000u\ufffd\ufffdj&j\r\ufffd\b\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8260,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:8260 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd9\ufffd\ufffdc\ufffd\ufffd \ufffd\ufffdq\u06cd,\ufffd}z\ufffd=S\ufffd\ufffd,=o\ufffd^:5 \ufffdx\ufffd\r^:\"\ufffde_jxu\ufffd\ufffdj&j\r\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8260 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:06 UTC
TCP
8260 · TLS
Sonde PostgreSQL
postgres probe · via TLS:8260 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8260
Chemin / cible
—
Service
TLS
Payload
� �*;W��ńZ ���S-��' $hf�6�[ �R�c��Q�b�JB��j��Bh��s^Yv��cZ &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �*;W��ńZ ���S-��'
$hf�6�[ �R�c��Q�b�JB��j��Bh��s^Yv��cZ
&�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� �*;W��ńZ ���S-��' $hf�6�[ �R�c��Q�b�JB��j��Bh��s^Yv��cZ &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ �:��� =�4� �>�7�t�o|�i3�! L
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.855748904266994,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "63078d6f18cf1751dc4fcf365472528190d837ea",
"event_fingerprint": "73e984194c8d37522e0e3314b145e12f5da46517",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "5e4234834c39e7c7327ddd13bd62c2aa",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8260,
"service": "tls",
"service_name": "tls",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003*;W\ufffd\ufffdn\u0301Z\f\u0017\u000e\ufffd\ufffd\ufffdS\u0002\u0005-\u0019\ufffd\ufffd'\r$hf\ufffd6\ufffd[ \ufffdR\ufffdc\ufffd\ufffdQ\ufffdb\ufffdJB\ufffd\ufffdj\ufffd\ufffdBh\ufffd\ufffds^Yv\ufffd\ufffdcZ\n\u0018\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003*;W\ufffd\ufffdn\u0301Z\f\u0017\u000e\ufffd\ufffd\ufffdS\u0002\u0005-\u0019\ufffd\ufffd'\r$hf\ufffd6\ufffd[ \ufffdR\ufffdc\ufffd\ufffdQ\ufffdb\ufffdJB\ufffd\ufffdj\ufffd\ufffdBh\ufffd\ufffds^Yv\ufffd\ufffdcZ\n\u0018\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u0006:\ufffd\ufffd\ufffd\u001f=\u000e\ufffd4\ufffd\r\ufffd>\ufffd7\u0018\ufffdt\ufffdo|\ufffdi3\ufffd\u0005!\fL\u000f",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003*;W\ufffd\ufffdn\u0301Z\f\u0017\u000e\ufffd\ufffd\ufffdS\u0002\u0005-\u0019\ufffd\ufffd'\r$hf\ufffd6\ufffd[ \ufffdR\ufffdc\ufffd\ufffdQ\ufffdb\ufffdJB\ufffd\ufffdj\ufffd\ufffdBh\ufffd\ufffds^Yv\ufffd\ufffdcZ\n\u0018\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "11e2660bec78a63e541dc62d3f2b152934edefc3",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003*;W\ufffd\ufffdn\u0301Z\f\u0017\u000e\ufffd\ufffd\ufffdS\u0002\u0005-\u0019\ufffd\ufffd'\r$hf\ufffd6\ufffd[ \ufffdR\ufffdc\ufffd\ufffdQ\ufffdb\ufffdJB\ufffd\ufffdj\ufffd\ufffdBh\ufffd\ufffds^Yv\ufffd\ufffdcZ\n\u0018\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8260,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd*;W\ufffd\ufffdn\u0301Z\ufffd\ufffd\ufffdS-\ufffd\ufffd'\r$hf\ufffd6\ufffd[ \ufffdR\ufffdc\ufffd\ufffdQ\ufffdb\ufffdJB\ufffd\ufffdj\ufffd\ufffdBh\ufffd\ufffds^Yv\ufffd\ufffdcZ\n&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via TLS:8260 \u00b7 (sonde \/ probe)",
"target_port_label": "8260 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003*;W\ufffd\ufffdn\u0301Z\f\u0017\u000e\ufffd\ufffd\ufffdS\u0002\u0005-\u0019\ufffd\ufffd'\r$hf\ufffd6\ufffd[ \ufffdR\ufffdc\ufffd\ufffdQ\ufffdb\ufffdJB\ufffd\ufffdj\ufffd\ufffdBh\ufffd\ufffds^Yv\ufffd\ufffdcZ\n\u0018\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8260,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:8260 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd*;W\ufffd\ufffdn\u0301Z\ufffd\ufffd\ufffdS-\ufffd\ufffd'\r$hf\ufffd6\ufffd[ \ufffdR\ufffdc\ufffd\ufffdQ\ufffdb\ufffdJB\ufffd\ufffdj\ufffd\ufffdBh\ufffd\ufffds^Yv\ufffd\ufffdcZ\n&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8260 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:06 UTC
TCP
8260 · TLS
Sonde PostgreSQL
postgres probe · via TLS:8260 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8260
Chemin / cible
—
Service
TLS
Payload
� �%���v*@ ( �E������ &�E����$r�� 6� � 0�V������S���N,�J#� � lm &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �%���v*@ ( �E������ &�E����$r�� 6� � 0�V������S���N,�J#� �
lm &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� �%���v*@ ( �E������ &�E����$r�� 6� � 0�V������S���N,�J#� � lm &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ w���=?]/��fh ��83��ާ��v/@,x�d
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.834057075626681,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "63078d6f18cf1751dc4fcf365472528190d837ea",
"event_fingerprint": "73e984194c8d37522e0e3314b145e12f5da46517",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "01dce96276b3fa5ff98d3722b4f82e42",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8260,
"service": "tls",
"service_name": "tls",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003%\ufffd\ufffd\ufffdv*@\u001d(\u001e\ufffdE\ufffd\u0015\ufffd\ufffd\ufffd\ufffd\ufffd\u001c&\ufffdE\ufffd\ufffd\ufffd\ufffd\u0010$r\ufffd\ufffd 6\ufffd\u001f\ufffd\u000b0\ufffdV\ufffd\ufffd\ufffd\u0014\ufffd\ufffd\ufffd\u0011S\ufffd\ufffd\ufffdN,\ufffdJ#\ufffd \ufffd\nlm\u0012\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003%\ufffd\ufffd\ufffdv*@\u001d(\u001e\ufffdE\ufffd\u0015\ufffd\ufffd\ufffd\ufffd\ufffd\u001c&\ufffdE\ufffd\ufffd\ufffd\ufffd\u0010$r\ufffd\ufffd 6\ufffd\u001f\ufffd\u000b0\ufffdV\ufffd\ufffd\ufffd\u0014\ufffd\ufffd\ufffd\u0011S\ufffd\ufffd\ufffdN,\ufffdJ#\ufffd \ufffd\nlm\u0012\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 w\ufffd\ufffd\ufffd=?]\/\ufffd\ufffdfh\n\ufffd\ufffd8\u00143\ufffd\ufffd\u07a7\ufffd\ufffdv\u0002\/@,x\ufffdd",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003%\ufffd\ufffd\ufffdv*@\u001d(\u001e\ufffdE\ufffd\u0015\ufffd\ufffd\ufffd\ufffd\ufffd\u001c&\ufffdE\ufffd\ufffd\ufffd\ufffd\u0010$r\ufffd\ufffd 6\ufffd\u001f\ufffd\u000b0\ufffdV\ufffd\ufffd\ufffd\u0014\ufffd\ufffd\ufffd\u0011S\ufffd\ufffd\ufffdN,\ufffdJ#\ufffd \ufffd\nlm\u0012\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e54f2a62ad831b9392756cb174d5c11cd816af49",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003%\ufffd\ufffd\ufffdv*@\u001d(\u001e\ufffdE\ufffd\u0015\ufffd\ufffd\ufffd\ufffd\ufffd\u001c&\ufffdE\ufffd\ufffd\ufffd\ufffd\u0010$r\ufffd\ufffd 6\ufffd\u001f\ufffd\u000b0\ufffdV\ufffd\ufffd\ufffd\u0014\ufffd\ufffd\ufffd\u0011S\ufffd\ufffd\ufffdN,\ufffdJ#\ufffd \ufffd\nlm\u0012\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8260,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd%\ufffd\ufffd\ufffdv*@(\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffdE\ufffd\ufffd\ufffd\ufffd$r\ufffd\ufffd 6\ufffd\ufffd0\ufffdV\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\ufffdN,\ufffdJ#\ufffd \ufffd\nlm&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via TLS:8260 \u00b7 (sonde \/ probe)",
"target_port_label": "8260 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003%\ufffd\ufffd\ufffdv*@\u001d(\u001e\ufffdE\ufffd\u0015\ufffd\ufffd\ufffd\ufffd\ufffd\u001c&\ufffdE\ufffd\ufffd\ufffd\ufffd\u0010$r\ufffd\ufffd 6\ufffd\u001f\ufffd\u000b0\ufffdV\ufffd\ufffd\ufffd\u0014\ufffd\ufffd\ufffd\u0011S\ufffd\ufffd\ufffdN,\ufffdJ#\ufffd \ufffd\nlm\u0012\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8260,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:8260 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd%\ufffd\ufffd\ufffdv*@(\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffdE\ufffd\ufffd\ufffd\ufffd$r\ufffd\ufffd 6\ufffd\ufffd0\ufffdV\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\ufffdN,\ufffdJ#\ufffd \ufffd\nlm&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8260 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:06 UTC
TCP
8260 · TLS
Sonde PostgreSQL
postgres probe · via TLS:8260 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_flood
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8260
Chemin / cible
—
Service
TLS
Payload
� ��E��f�$*��V�}�[ |rN?���Rv��0E �k���ή��ť��Hg�.�o/չ� &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��E��f�$*��V�}�[ |rN?���Rv��0E �k���ή��ť��Hg�.�o/չ� &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� ��E��f�$*��V�}�[ |rN?���Rv��0E �k���ή��ť��Hg�.�o/չ� &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ �����K�c���]ñ S~ba��% z�M
Meta JSON brut
{
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 239,
"payload_entropy": 5.806319694166605,
"port_category": "registered",
"org": "Google LLC",
"service": "tls",
"app_proto": "tls",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "63078d6f18cf1751dc4fcf365472528190d837ea",
"event_fingerprint": "73e984194c8d37522e0e3314b145e12f5da46517",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "19e29534fd49dd27d09234e639c4057e",
"payload_hash": "42e0618e3ce25642ace02771fa351da3",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8260,
"service": "tls",
"service_name": "tls",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0013\ufffdE\ufffd\ufffdf\ufffd$*\ufffd\ufffdV\ufffd}\ufffd\u0004[ |rN?\u0016\ufffd\ufffd\ufffdRv\ufffd\ufffd0E \u000b\u0006\t\ufffdk\ufffd\ufffd\ufffd\u03ae\ufffd\ufffd\u0165\ufffd\ufffdHg\ufffd.\udb96\udf01\ufffdo\u001a\/\b\u0579\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0013\ufffdE\ufffd\ufffdf\ufffd$*\ufffd\ufffdV\ufffd}\ufffd\u0004[ |rN?\u0016\ufffd\ufffd\ufffdRv\ufffd\ufffd0E \u000b\u0006\t\ufffdk\ufffd\ufffd\ufffd\u03ae\ufffd\ufffd\u0165\ufffd\ufffdHg\ufffd.\udb96\udf01\ufffdo\u001a\/\b\u0579\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \u001c\ufffd\ufffd\ufffd\u0004\ufffd\ufffd\u0002K\ufffdc\ufffd\ufffd\ufffd]\u00f1 \u001d\u0019S~ba\ufffd\ufffd%\u0000z\ufffdM\u0014",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0013\ufffdE\ufffd\ufffdf\ufffd$*\ufffd\ufffdV\ufffd}\ufffd\u0004[ |rN?\u0016\ufffd\ufffd\ufffdRv\ufffd\ufffd0E \u000b\u0006\t\ufffdk\ufffd\ufffd\ufffd\u03ae\ufffd\ufffd\u0165\ufffd\ufffdHg\ufffd.\udb96\udf01\ufffdo\u001a\/\b\u0579\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5b486e4d50d3a18c42a405e7be58f883af102230",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0013\ufffdE\ufffd\ufffdf\ufffd$*\ufffd\ufffdV\ufffd}\ufffd\u0004[ |rN?\u0016\ufffd\ufffd\ufffdRv\ufffd\ufffd0E \u000b\u0006\t\ufffdk\ufffd\ufffd\ufffd\u03ae\ufffd\ufffd\u0165\ufffd\ufffdHg\ufffd.\udb96\udf01\ufffdo\u001a\/\b\u0579\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8260,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdE\ufffd\ufffdf\ufffd$*\ufffd\ufffdV\ufffd}\ufffd[ |rN?\ufffd\ufffd\ufffdRv\ufffd\ufffd0E \t\ufffdk\ufffd\ufffd\ufffd\u03ae\ufffd\ufffd\u0165\ufffd\ufffdHg\ufffd.\udb96\udf01\ufffdo\/\u0579\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via TLS:8260 \u00b7 (sonde \/ probe)",
"target_port_label": "8260 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0013\ufffdE\ufffd\ufffdf\ufffd$*\ufffd\ufffdV\ufffd}\ufffd\u0004[ |rN?\u0016\ufffd\ufffd\ufffdRv\ufffd\ufffd0E \u000b\u0006\t\ufffdk\ufffd\ufffd\ufffd\u03ae\ufffd\ufffd\u0165\ufffd\ufffdHg\ufffd.\udb96\udf01\ufffdo\u001a\/\b\u0579\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8260,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:8260 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdE\ufffd\ufffdf\ufffd$*\ufffd\ufffdV\ufffd}\ufffd[ |rN?\ufffd\ufffd\ufffdRv\ufffd\ufffd0E \t\ufffdk\ufffd\ufffd\ufffd\u03ae\ufffd\ufffd\u0165\ufffd\ufffdHg\ufffd.\udb96\udf01\ufffdo\/\u0579\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8260 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_flood",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:06 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /src/.env.production
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /src/.env.production UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/src/.env.production
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/src/.env.production
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /src/.env.production HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36 OPR/62.0.3331.72
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /src/.env.production HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.
Requête brute (extrait)
GET /src/.env.production HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36 OPR/62.0.3331.72 Accept-Charset: utf-8 Accept-Encoding: gzip Connec
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "production",
"http_ua_hash": "e6cec56385f2b2080b6fc4b0558453debf3d5e8f",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "599f2d9bd6aa582bb5354e432e5e7dbc94c61beb",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 271,
"payload_entropy": 5.414080364958418,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "0a29d72c394fcba0c14da0678f1848da05a5a5c6",
"event_fingerprint": "2c1c8c123843f701859d4a255d107244bc9ff18c",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "aacde460e32c5ba84404420abe398e82",
"payload_hash": "346d1dae72318e78647402e90d87800c",
"path_pattern_hash": "e052e9698e07c6e60c0f023221efaf20"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/src\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"method": "GET",
"path": "\/src\/.env.production",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36 OPR\/62.0.3331.72",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/src\/.env.production HTTP\/1.1",
"request_sample": "GET \/src\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36 OPR\/62.0.3331.72\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnec",
"payload_snippet": "GET \/src\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/src\/.env.production",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36 OPR\/62.0.3331.72",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/src\/.env.production HTTP\/1.1",
"request_sample": "GET \/src\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36 OPR\/62.0.3331.72\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnec",
"payload_snippet": "GET \/src\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6d532d6042fe824bd4464b885fef05623fc8a4f1",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/.env.production",
"request_line": "GET \/src\/.env.production HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36 OPR\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/src\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/.env.production",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/.env.production",
"request_line": "GET \/src\/.env.production HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36 OPR\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/.env.production",
"evidence_snippet": "GET \/src\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:06 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /src/.env.backup
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /src/.env.backup UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit/537…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/src/.env.backup
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/src/.env.backup
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /src/.env.backup HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /src/.env.backup HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit/53
Requête brute (extrait)
GET /src/.env.backup HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "backup",
"http_ua_hash": "13bf1ed634979e95ea6a17c225acb506daaf2e3a",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "e2c1e948277f8c3df734e217f074ce4258c3cbfa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 256,
"payload_entropy": 5.423366720926822,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "0a29d72c394fcba0c14da0678f1848da05a5a5c6",
"event_fingerprint": "24d3ad70375316d7e93bfd360c95d4b0db681435",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "32fbac56422afd8c8f7d41b6a5eab6c2",
"payload_hash": "af5f33f232cbac1792cef2edc8259a99",
"path_pattern_hash": "c8b12b4b569bce0b37c2e64eafb947f3"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/src\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit\/53",
"method": "GET",
"path": "\/src\/.env.backup",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/src\/.env.backup HTTP\/1.1",
"request_sample": "GET \/src\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/src\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit\/53",
"evidence": {
"method": "GET",
"path": "\/src\/.env.backup",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/src\/.env.backup HTTP\/1.1",
"request_sample": "GET \/src\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/src\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit\/53",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3757346ede65762d40ea9b4c5b83abe9fea42049",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/.env.backup",
"request_line": "GET \/src\/.env.backup HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/src\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit\/53",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/.env.backup",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/.env.backup",
"request_line": "GET \/src\/.env.backup HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/.env.backup",
"evidence_snippet": "GET \/src\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit\/53",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:06 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /server/.env.production
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /server/.env.production UA Mozilla/5.0 (Linux; Android 9; MI 8 Lite) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/server/.env.production
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/server/.env.production
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /server/.env.production HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; MI 8 Lite) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /server/.env.production HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (Linux; Android 9; MI 8 Lite) AppleWebKit/5
Requête brute (extrait)
GET /server/.env.production HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (Linux; Android 9; MI 8 Lite) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: c
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "production",
"http_ua_hash": "9ba22dd8ad9558ebbc8f8370ac0d7e612d757f82",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "c5a8bf9f86075206f2cab5a2cf1a94aed3e22719",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 264,
"payload_entropy": 5.377677176566605,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "0a29d72c394fcba0c14da0678f1848da05a5a5c6",
"event_fingerprint": "d47af18b046b8ccaf09037daa19674e7b0c638fa",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7dc84e51debc09075d0d733750c18e6a",
"payload_hash": "36c5f881134496a8826ced4baaa9af3e",
"path_pattern_hash": "a00e13282480bcd571abdd94022996e0"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/server\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; MI 8 Lite) AppleWebKit\/5",
"method": "GET",
"path": "\/server\/.env.production",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; MI 8 Lite) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/server\/.env.production HTTP\/1.1",
"request_sample": "GET \/server\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; MI 8 Lite) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: c",
"payload_snippet": "GET \/server\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; MI 8 Lite) AppleWebKit\/5",
"evidence": {
"method": "GET",
"path": "\/server\/.env.production",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; MI 8 Lite) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/server\/.env.production HTTP\/1.1",
"request_sample": "GET \/server\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; MI 8 Lite) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: c",
"payload_snippet": "GET \/server\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; MI 8 Lite) AppleWebKit\/5",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5cf30d118a544a7b11f7494df12a57e1e3f8d696",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server\/.env.production",
"request_line": "GET \/server\/.env.production HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; MI 8 Lite) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/server\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; MI 8 Lite) AppleWebKit\/5",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server\/.env.production",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server\/.env.production",
"request_line": "GET \/server\/.env.production HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; MI 8 Lite) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537\u2026",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server\/.env.production",
"evidence_snippet": "GET \/server\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; MI 8 Lite) AppleWebKit\/5",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:06 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /server/.env.local
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /server/.env.local UA Avant Browser/1.2.789rel1 (http://www.avantbrowser.com)
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950406:ssrf-3
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/server/.env.local
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/server/.env.local
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « ssrf-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /server/.env.local HTTP/1.1
User-Agent
Avant Browser/1.2.789rel1 (http://www.avantbrowser.com)
Règles WAF
ssrf-3
nosqli-3
leak-1
Payload (extrait)
GET /server/.env.local HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Avant Browser/1.2.789rel1 (http://www.avantbrowser.com)
Acc
Requête brute (extrait)
GET /server/.env.local HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Avant Browser/1.2.789rel1 (http://www.avantbrowser.com) Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "local",
"http_ua_hash": "d2252eb771e4eec88081691e9a7fe02000ef5b62",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "3a4429a6d5f41cf5d304f80d456adb35465617d3",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 192,
"payload_entropy": 5.1480370375002416,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "b1abea76dff342e8642b90c530f5686c192f8db6",
"event_fingerprint": "8b326fead3a291e37f09bcdd02d92b9dae2b2ae1",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "4944e79cd760319f0194b0c3c7e7e440",
"payload_hash": "a562544e0685ad17e9397ec74751ecdb",
"path_pattern_hash": "9eb6847465270ab8b74f01d8fe541218"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/server\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Avant Browser\/1.2.789rel1 (http:\/\/www.avantbrowser.com)\r\nAcc",
"method": "GET",
"path": "\/server\/.env.local",
"user_agent": "Avant Browser\/1.2.789rel1 (http:\/\/www.avantbrowser.com)",
"waf_tags": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/server\/.env.local HTTP\/1.1",
"request_sample": "GET \/server\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Avant Browser\/1.2.789rel1 (http:\/\/www.avantbrowser.com)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/server\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Avant Browser\/1.2.789rel1 (http:\/\/www.avantbrowser.com)\r\nAcc",
"evidence": {
"method": "GET",
"path": "\/server\/.env.local",
"user_agent": "Avant Browser\/1.2.789rel1 (http:\/\/www.avantbrowser.com)",
"waf_tags": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/server\/.env.local HTTP\/1.1",
"request_sample": "GET \/server\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Avant Browser\/1.2.789rel1 (http:\/\/www.avantbrowser.com)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/server\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Avant Browser\/1.2.789rel1 (http:\/\/www.avantbrowser.com)\r\nAcc",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2993e328ba0bcb1a8a289da8ff489503b879aca0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server\/.env.local",
"request_line": "GET \/server\/.env.local HTTP\/1.1",
"http_user_agent": "Avant Browser\/1.2.789rel1 (http:\/\/www.avantbrowser.com)",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/server\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Avant Browser\/1.2.789rel1 (http:\/\/www.avantbrowser.com)\r\nAcc",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server\/.env.local",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server\/.env.local",
"request_line": "GET \/server\/.env.local HTTP\/1.1",
"http_user_agent": "Avant Browser\/1.2.789rel1 (http:\/\/www.avantbrowser.com)",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server\/.env.local",
"evidence_snippet": "GET \/server\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Avant Browser\/1.2.789rel1 (http:\/\/www.avantbrowser.com)\r\nAcc",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:06 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /private/.env.production
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /private/.env.production UA Mozilla/5.0 (Windows NT 6.2) AppleWebKit/536.3 (KHTML, like Gec…
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950468:nosqli-3
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/private/.env.production
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/private/.env.production
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /private/.env.production HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.2) AppleWebKit/536.3 (KHTML, like Gecko) Chrome/19.0.1061.1 Safari/536.3
Règles WAF
nosqli-3
leak-1
Payload (extrait)
GET /private/.env.production HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/536.3 (KHTML,
Requête brute (extrait)
GET /private/.env.production HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/536.3 (KHTML, like Gecko) Chrome/19.0.1061.1 Safari/536.3 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "production",
"http_ua_hash": "e576e94dad83cd52177cb9ef926a3d4095dd883d",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "733a894b07d9b79b5b4ab7169336337873d659bc",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 241,
"payload_entropy": 5.335798850148283,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 88,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 88,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 64,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "8b3e9b675ae2c430a540664115d94a381a8f644c",
"event_fingerprint": "818a80d3cf10affeb32e05e94f3721168f23ee24",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 88,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 64,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "28b5a0abf8f5a3dc2974b5b5cc32be49",
"payload_hash": "a80e48e35d0d430deeb5db4750259a6d",
"path_pattern_hash": "d172a4f1c2b0f77cc0bf21a5051067d5"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/private\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/536.3 (KHTML,",
"method": "GET",
"path": "\/private\/.env.production",
"user_agent": "Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/536.3 (KHTML, like Gecko) Chrome\/19.0.1061.1 Safari\/536.3",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"nosqli-3",
"leak-1"
],
"request_line": "GET \/private\/.env.production HTTP\/1.1",
"request_sample": "GET \/private\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/536.3 (KHTML, like Gecko) Chrome\/19.0.1061.1 Safari\/536.3\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/private\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/536.3 (KHTML,",
"evidence": {
"method": "GET",
"path": "\/private\/.env.production",
"user_agent": "Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/536.3 (KHTML, like Gecko) Chrome\/19.0.1061.1 Safari\/536.3",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"nosqli-3",
"leak-1"
],
"request_line": "GET \/private\/.env.production HTTP\/1.1",
"request_sample": "GET \/private\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/536.3 (KHTML, like Gecko) Chrome\/19.0.1061.1 Safari\/536.3\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/private\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/536.3 (KHTML,",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4765832cbeb94a115e00570eafce8fd70cb46ae7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/private\/.env.production",
"request_line": "GET \/private\/.env.production HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/536.3 (KHTML, like Gecko) Chrome\/19.0.1061.1 Safari\/536.3",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/private\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/536.3 (KHTML,",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/private\/.env.production",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 64,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/private\/.env.production",
"request_line": "GET \/private\/.env.production HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/536.3 (KHTML, like Gecko) Chrome\/19.0.1061.1 Safari\/536.3",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/private\/.env.production",
"evidence_snippet": "GET \/private\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/536.3 (KHTML,",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_probe_private",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:06 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /private/.env
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /private/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/private/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/private/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /private/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.42 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /private/.env HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHT
Requête brute (extrait)
GET /private/.env HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.42 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "45f91def00f8b8a4e84a5e46a0602e992f7966c1",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "42ecb4d5f4be7b556e157ee15a288da92dfb0e45",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 246,
"payload_entropy": 5.418040397104443,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "bf666c3ce087b9fa3c35b29df50d347838abc890",
"event_fingerprint": "b9b24528240788ef534c066493762669d797fd55",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "236db24e4793d97e5cd528d7002c4996",
"payload_hash": "e5382f7b86269f18ed76805f23fdccc0",
"path_pattern_hash": "467844c5e65593cac952660a5e740364"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/private\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"method": "GET",
"path": "\/private\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/77.0.3865.42 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/private\/.env HTTP\/1.1",
"request_sample": "GET \/private\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/77.0.3865.42 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/private\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"evidence": {
"method": "GET",
"path": "\/private\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/77.0.3865.42 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/private\/.env HTTP\/1.1",
"request_sample": "GET \/private\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/77.0.3865.42 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/private\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1470b0b07f19b181ceeddeee973a255364f92a98",
"protocol_details": {
"http_method": "GET",
"http_path": "\/private\/.env",
"request_line": "GET \/private\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/77.0.3865.42 Safari\/537.36",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/private\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/private\/.env",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/private\/.env",
"request_line": "GET \/private\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/77.0.3865.42 Safari\/537.36",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/private\/.env",
"evidence_snippet": "GET \/private\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_probe_private",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 16:02:06 UTC
TCP
8260 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8260 · (tentative d'exploit) · → /server/.env
Élevée
Critique · 85
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /server/.env UA Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Émulateur
HTTP
WAF
21
Recommandation
Bloquer (recommandé)
Tags
950326:rce-0
950468:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/server/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8260
Chemin / cible
/server/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Critique
· 85
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /server/.env HTTP/1.1
User-Agent
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /server/.env HTTP/1.1
Host: 62.3.50.33:8260
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Accept-Charset
Requête brute (extrait)
GET /server/.env HTTP/1.1 Host: 62.3.50.33:8260 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "96e1db10c74ac5f8e9c335efe735320e22b5dbee",
"http_host_hash": "0761dd68e976ddfa28100121d9dcefa020fb01d1",
"http_target_hash": "394e130162f84b369da768999af4d972a2c7e141",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 181,
"payload_entropy": 5.282851574498802,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "TW",
"dst_port": 8260,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 85,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "debb0941c726a89f8697391a0237013e9dab47b7",
"event_fingerprint": "65e51a7587c99b5eb9d402122eb29ba2467fade6",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 85,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "dd31faa4256f873e33967d39c189a795",
"payload_hash": "5154ce23e2551c8cc901fe39bba2e904",
"path_pattern_hash": "54554b038eab677020ee0c0c2a53bac1"
},
"target_context": {
"dst_port": 8260,
"service": "http",
"service_name": "http",
"risk_score": 85
},
"payload_preview": "GET \/server\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 6.0; Windows NT 5.1)\r\nAccept-Charset",
"method": "GET",
"path": "\/server\/.env",
"user_agent": "Mozilla\/4.0 (compatible; MSIE 6.0; Windows NT 5.1)",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/server\/.env HTTP\/1.1",
"request_sample": "GET \/server\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 6.0; Windows NT 5.1)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/server\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 6.0; Windows NT 5.1)\r\nAccept-Charset",
"evidence": {
"method": "GET",
"path": "\/server\/.env",
"user_agent": "Mozilla\/4.0 (compatible; MSIE 6.0; Windows NT 5.1)",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/server\/.env HTTP\/1.1",
"request_sample": "GET \/server\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 6.0; Windows NT 5.1)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/server\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 6.0; Windows NT 5.1)\r\nAccept-Charset",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "block",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3359135db5153a56b9754233980ab2f5019f6615",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server\/.env",
"request_line": "GET \/server\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/4.0 (compatible; MSIE 6.0; Windows NT 5.1)",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/server\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 6.0; Windows NT 5.1)\r\nAccept-Charset",
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server\/.env",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 85\/100 (Critique) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 85,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 85,
"risk_label": "Critique",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8260,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "block",
"recommended_action_label": "Bloquer (recommand\u00e9)",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server\/.env",
"request_line": "GET \/server\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/4.0 (compatible; MSIE 6.0; Windows NT 5.1)",
"port": 8260,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8260 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server\/.env",
"evidence_snippet": "GET \/server\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8260\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 6.0; Windows NT 5.1)\r\nAccept-Charset",
"target_port_label": "8260 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8260"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_block",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_metasploit_ua",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}