|
|
TCP |
8090 · HTTP ALT 8090
|
http-alt-8090
|
http-alt-8090
http-alt-8090 · via HTTP ALT 8090:8090 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 996df8df20e9c82f
Émulateur
HTTP-ALT-8090
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8090
Chemin / cible
—
Service
HTTP ALT 8090
Payload
� �U����x�o{n������QT(��+:ѱ�[�� 鍁��p7|���H���֪D�C��lw��n�k�� �,�+̩�0�/̨ � � http/1.1 #
Pourquoi cette classification : Type « http-alt-8090 » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �U����x�o{n������QT(��+:ѱ�[�� 鍁��p7|���H���֪D�C��lw��n�k�� �,�+̩�0�/̨ � � http/1.1 #
Requête brute (extrait)
� �U����x�o{n������QT(��+:ѱ�[�� 鍁��p7|���H���֪D�C��lw��n�k�� �,�+̩�0�/̨ � � http/1.1 # 3 & $ O�x����������`��������4 ~�z - +
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 241,
"payload_entropy": 5.931970568710631,
"port_category": "registered",
"org": "Google LLC",
"service": "http-alt-8090",
"app_proto": "http-alt-8090",
"asn": 396982,
"country": "JP",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "fc06c824df4a804d476b0e89a599ce8d4ad2c0c4",
"event_fingerprint": "73de1024b23993e40693db328fc9a5b5266e5167",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "http-alt-8090",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1c145f61612c2cf3f6f95bba6c99c3d9",
"path_pattern_hash": "ced820066cc8b42921bb5be056af57a9",
"ja3": "996df8df20e9c82f95fd775797d8d3eb",
"ja4": "ea42f70dc665354616b338205d7b444f",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "996df8df20e9c82f95fd775797d8d3eb",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,23-16-35-5-13-10-51-45-11-43,29-23-24,0",
"tls_ja4_hash": "ea42f70dc665354616b338205d7b444f",
"tls_ja4": "t13d0110_8c4772bfca96_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8090,
"service": "http-alt-8090",
"service_name": "http-alt-8090",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003U\ufffd\ufffd\ufffd\ufffdx\ufffdo{n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u008d\u0007QT(\ufffd\ufffd+:\u0471\ufffd[\ufffd\ufffd \u9341\ufffd\ufffdp7|\ufffd\ufffd\ufffdH\ufffd\ufffd\ufffd\u05aaD\u0006\ufffdC\ufffd\ufffdlw\ufffd\ufffdn\ufffdk\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000#\u0000\u0000\u0000\u0005\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003U\ufffd\ufffd\ufffd\ufffdx\ufffdo{n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u008d\u0007QT(\ufffd\ufffd+:\u0471\ufffd[\ufffd\ufffd \u9341\ufffd\ufffdp7|\ufffd\ufffd\ufffdH\ufffd\ufffd\ufffd\u05aaD\u0006\ufffdC\ufffd\ufffdlw\ufffd\ufffdn\ufffdk\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000#\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u00003\u0000&\u0000$\u0000\u001d\u0000 \nO\ufffdx\ufffd\ufffd\u0010\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0019\ufffd`\u0004\ufffd\ufffd\u0015\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd4\u0000~\ufffdz\u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003U\ufffd\ufffd\ufffd\ufffdx\ufffdo{n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u008d\u0007QT(\ufffd\ufffd+:\u0471\ufffd[\ufffd\ufffd \u9341\ufffd\ufffdp7|\ufffd\ufffd\ufffdH\ufffd\ufffd\ufffd\u05aaD\u0006\ufffdC\ufffd\ufffdlw\ufffd\ufffdn\ufffdk\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000#\u0000\u0000\u0000\u0005\u0000",
"classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2a0eb24eefe6133685ffd633b699906140676d38",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003U\ufffd\ufffd\ufffd\ufffdx\ufffdo{n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u008d\u0007QT(\ufffd\ufffd+:\u0471\ufffd[\ufffd\ufffd \u9341\ufffd\ufffdp7|\ufffd\ufffd\ufffdH\ufffd\ufffd\ufffd\u05aaD\u0006\ufffdC\ufffd\ufffdlw\ufffd\ufffdn\ufffdk\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000#\u0000\u0000\u0000\u0005\u0000",
"tls_ja3": "996df8df20e9c82f95fd775797d8d3eb",
"tls_ja4": "ea42f70dc665354616b338205d7b444f",
"port": 8090,
"service": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090"
},
"evidence_snippet": "\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffdx\ufffdo{n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u008dQT(\ufffd\ufffd+:\u0471\ufffd[\ufffd\ufffd \u9341\ufffd\ufffdp7|\ufffd\ufffd\ufffdH\ufffd\ufffd\ufffd\u05aaD\ufffdC\ufffd\ufffdlw\ufffd\ufffdn\ufffdk\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\thttp\/1.1#",
"attack_vector": "http-alt-8090 \u00b7 via HTTP ALT 8090:8090 \u00b7 (sonde \/ probe)",
"target_port_label": "8090 \u00b7 HTTP ALT 8090",
"emulator_service": "http-alt-8090",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8090",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003U\ufffd\ufffd\ufffd\ufffdx\ufffdo{n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u008d\u0007QT(\ufffd\ufffd+:\u0471\ufffd[\ufffd\ufffd \u9341\ufffd\ufffdp7|\ufffd\ufffd\ufffdH\ufffd\ufffd\ufffd\u05aaD\u0006\ufffdC\ufffd\ufffdlw\ufffd\ufffdn\ufffdk\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000#\u0000\u0000\u0000\u0005\u0000",
"tls_ja3": "996df8df20e9c82f95fd775797d8d3eb",
"tls_ja4": "ea42f70dc665354616b338205d7b444f",
"port": 8090,
"service": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090"
},
"attack_vector": "http-alt-8090 \u00b7 via HTTP ALT 8090:8090 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffdx\ufffdo{n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u008dQT(\ufffd\ufffd+:\u0471\ufffd[\ufffd\ufffd \u9341\ufffd\ufffdp7|\ufffd\ufffd\ufffdH\ufffd\ufffd\ufffd\u05aaD\ufffdC\ufffd\ufffdlw\ufffd\ufffdn\ufffdk\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\thttp\/1.1#",
"target_port_label": "8090 \u00b7 HTTP ALT 8090",
"emulator_service": "http-alt-8090",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8090",
"service_banner": "honeypot-http-alt-8090",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP ALT 8090
|
http-alt-8090
|
http-alt-8090
http-alt-8090 · via HTTP ALT 8090:8090 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 e744789c7698d1bc
Émulateur
HTTP-ALT-8090
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8090
Chemin / cible
—
Service
HTTP ALT 8090
Payload
� � Je����<�_�4���g�ʨ�ð1�o� �d� �X����o9+��rBb;�!��@?pxͅ��^�� �,�+̩�0�/̨ � � + -
Pourquoi cette classification : Type « http-alt-8090 » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� � Je����<�_�4���g�ʨ�ð1�o� �d� �X����o9+��rBb;�!��@?pxͅ��^�� �,�+̩�0�/̨ � � + -
Requête brute (extrait)
� � Je����<�_�4���g�ʨ�ð1�o� �d� �X����o9+��rBb;�!��@?pxͅ��^�� �,�+̩�0�/̨ � � + - # 3 & $ �si�0?-�� ��J��ڮ,���`wh: http/1.1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 241,
"payload_entropy": 5.9230088475912686,
"port_category": "registered",
"org": "Google LLC",
"service": "http-alt-8090",
"app_proto": "http-alt-8090",
"asn": 396982,
"country": "JP",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "fc06c824df4a804d476b0e89a599ce8d4ad2c0c4",
"event_fingerprint": "73de1024b23993e40693db328fc9a5b5266e5167",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "http-alt-8090",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "95bb0762fef1fe9cb2f383a0b019881d",
"path_pattern_hash": "ced820066cc8b42921bb5be056af57a9",
"ja3": "e744789c7698d1bcb0f0fee006153deb",
"ja4": "f3ec4a7ac6ce6e06b18247f705d0f875",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "e744789c7698d1bcb0f0fee006153deb",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,43-23-5-45-35-13-51-11-16-10,29-23-24,0",
"tls_ja4_hash": "f3ec4a7ac6ce6e06b18247f705d0f875",
"tls_ja4": "t13d0110_57517a49d0cb_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8090,
"service": "http-alt-8090",
"service_name": "http-alt-8090",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\tJe\ufffd\ufffd\ufffd\ufffd<\ufffd_\ufffd4\ufffd\ufffd\ufffdg\ufffd\u02a8\ufffd\u00f01\ufffdo\ufffd\u000b\ufffdd\ufffd \ufffdX\ufffd\ufffd\ufffd\ufffdo9+\ufffd\ufffdrBb;\ufffd!\ufffd\ufffd@?px\u0345\ufffd\ufffd^\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0017\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\tJe\ufffd\ufffd\ufffd\ufffd<\ufffd_\ufffd4\ufffd\ufffd\ufffdg\ufffd\u02a8\ufffd\u00f01\ufffdo\ufffd\u000b\ufffdd\ufffd \ufffdX\ufffd\ufffd\ufffd\ufffdo9+\ufffd\ufffdrBb;\ufffd!\ufffd\ufffd@?px\u0345\ufffd\ufffd^\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0017\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000#\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdsi\ufffd0\ue2b9?-\ufffd\ufffd\f\u001f\ufffd\ufffdJ\ufffd\ufffd\u06ae,\ufffd\ufffd\ufffd`wh\u001a:\u0002\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\tJe\ufffd\ufffd\ufffd\ufffd<\ufffd_\ufffd4\ufffd\ufffd\ufffdg\ufffd\u02a8\ufffd\u00f01\ufffdo\ufffd\u000b\ufffdd\ufffd \ufffdX\ufffd\ufffd\ufffd\ufffdo9+\ufffd\ufffdrBb;\ufffd!\ufffd\ufffd@?px\u0345\ufffd\ufffd^\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0017\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002",
"classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0f44c19f724a5988ace2fd3853aa0ae4ddb0b297",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\tJe\ufffd\ufffd\ufffd\ufffd<\ufffd_\ufffd4\ufffd\ufffd\ufffdg\ufffd\u02a8\ufffd\u00f01\ufffdo\ufffd\u000b\ufffdd\ufffd \ufffdX\ufffd\ufffd\ufffd\ufffdo9+\ufffd\ufffdrBb;\ufffd!\ufffd\ufffd@?px\u0345\ufffd\ufffd^\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0017\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002",
"tls_ja3": "e744789c7698d1bcb0f0fee006153deb",
"tls_ja4": "f3ec4a7ac6ce6e06b18247f705d0f875",
"port": 8090,
"service": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090"
},
"evidence_snippet": "\ufffd\ufffd\tJe\ufffd\ufffd\ufffd\ufffd<\ufffd_\ufffd4\ufffd\ufffd\ufffdg\ufffd\u02a8\ufffd\u00f01\ufffdo\ufffd\ufffdd\ufffd \ufffdX\ufffd\ufffd\ufffd\ufffdo9+\ufffd\ufffdrBb;\ufffd!\ufffd\ufffd@?px\u0345\ufffd\ufffd^\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+-",
"attack_vector": "http-alt-8090 \u00b7 via HTTP ALT 8090:8090 \u00b7 (sonde \/ probe)",
"target_port_label": "8090 \u00b7 HTTP ALT 8090",
"emulator_service": "http-alt-8090",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8090",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\tJe\ufffd\ufffd\ufffd\ufffd<\ufffd_\ufffd4\ufffd\ufffd\ufffdg\ufffd\u02a8\ufffd\u00f01\ufffdo\ufffd\u000b\ufffdd\ufffd \ufffdX\ufffd\ufffd\ufffd\ufffdo9+\ufffd\ufffdrBb;\ufffd!\ufffd\ufffd@?px\u0345\ufffd\ufffd^\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0017\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002",
"tls_ja3": "e744789c7698d1bcb0f0fee006153deb",
"tls_ja4": "f3ec4a7ac6ce6e06b18247f705d0f875",
"port": 8090,
"service": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090"
},
"attack_vector": "http-alt-8090 \u00b7 via HTTP ALT 8090:8090 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\tJe\ufffd\ufffd\ufffd\ufffd<\ufffd_\ufffd4\ufffd\ufffd\ufffdg\ufffd\u02a8\ufffd\u00f01\ufffdo\ufffd\ufffdd\ufffd \ufffdX\ufffd\ufffd\ufffd\ufffdo9+\ufffd\ufffdrBb;\ufffd!\ufffd\ufffd@?px\u0345\ufffd\ufffd^\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+-",
"target_port_label": "8090 \u00b7 HTTP ALT 8090",
"emulator_service": "http-alt-8090",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8090",
"service_banner": "honeypot-http-alt-8090",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP ALT 8090
|
http-alt-8090
|
http-alt-8090
http-alt-8090 · via HTTP ALT 8090:8090 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 e7cb6fa2d86a78c3
Émulateur
HTTP-ALT-8090
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8090
Chemin / cible
—
Service
HTTP ALT 8090
Payload
� �4����y�9����#Ӧhi��n.�ɸi�k>�h� �I�f]�5��[�&HlC0�� V�E(�WW)v� �,�+̩�0�/̨ � � + -
Pourquoi cette classification : Type « http-alt-8090 » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0768
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �4����y�9����#Ӧhi��n.�ɸi�k>�h� �I�f]�5��[�&HlC0��
V�E(�WW)v� �,�+̩�0�/̨ � � +
-
Requête brute (extrait)
� �4����y�9����#Ӧhi��n.�ɸi�k>�h� �I�f]�5��[�&HlC0�� V�E(�WW)v� �,�+̩�0�/̨ � � + - http/1.1 3 & $ %u o �6˴nX��t:����l]�Ho��T #
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 241,
"payload_entropy": 5.889651586108664,
"port_category": "registered",
"org": "Google LLC",
"service": "http-alt-8090",
"app_proto": "http-alt-8090",
"asn": 396982,
"country": "JP",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "fc06c824df4a804d476b0e89a599ce8d4ad2c0c4",
"event_fingerprint": "73de1024b23993e40693db328fc9a5b5266e5167",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0768"
],
"classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "http-alt-8090",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f629613ccbcc83041ca7db66ec6b5b36",
"path_pattern_hash": "ced820066cc8b42921bb5be056af57a9",
"ja3": "e7cb6fa2d86a78c3ecdcdbaba042490f",
"ja4": "a25e1ff9dd19d6efff5dbeaafce321c2",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "e7cb6fa2d86a78c3ecdcdbaba042490f",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,43-10-45-16-51-23-35-13-11-5,29-23-24,0",
"tls_ja4_hash": "a25e1ff9dd19d6efff5dbeaafce321c2",
"tls_ja4": "t13d0110_f85b5bbb716a_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8090,
"service": "http-alt-8090",
"service_name": "http-alt-8090",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00034\ufffd\ufffd\ufffd\ufffdy\ufffd9\ufffd\ufffd\ufffd\ufffd#\u04e6hi\ufffd\u0006\ufffdn.\ufffd\u0278i\ufffdk>\ufffdh\ufffd \ufffdI\ufffdf]\ufffd5\ufffd\ufffd[\ufffd&HlC0\ufffd\ufffd\rV\ufffdE(\ufffdWW)v\ufffd\u001d\b\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000-\u0000\u0002\u0001",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00034\ufffd\ufffd\ufffd\ufffdy\ufffd9\ufffd\ufffd\ufffd\ufffd#\u04e6hi\ufffd\u0006\ufffdn.\ufffd\u0278i\ufffdk>\ufffdh\ufffd \ufffdI\ufffdf]\ufffd5\ufffd\ufffd[\ufffd&HlC0\ufffd\ufffd\rV\ufffdE(\ufffdWW)v\ufffd\u001d\b\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000-\u0000\u0002\u0001\u0001\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u00003\u0000&\u0000$\u0000\u001d\u0000 %\u0019u\fo\n\t\ufffd6\u02f4nX\ufffd\ufffdt:\ufffd\ufffd\u0018\ufffd\ufffd\u0006l]\ufffdHo\ufffd\ufffd\u0002T\u0000\u0017\u0000\u0000\u0000#\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00034\ufffd\ufffd\ufffd\ufffdy\ufffd9\ufffd\ufffd\ufffd\ufffd#\u04e6hi\ufffd\u0006\ufffdn.\ufffd\u0278i\ufffdk>\ufffdh\ufffd \ufffdI\ufffdf]\ufffd5\ufffd\ufffd[\ufffd&HlC0\ufffd\ufffd\rV\ufffdE(\ufffdWW)v\ufffd\u001d\b\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000-\u0000\u0002\u0001",
"classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9746b1b7bd51244fb113d205588aecc1a3afa3ef",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00034\ufffd\ufffd\ufffd\ufffdy\ufffd9\ufffd\ufffd\ufffd\ufffd#\u04e6hi\ufffd\u0006\ufffdn.\ufffd\u0278i\ufffdk>\ufffdh\ufffd \ufffdI\ufffdf]\ufffd5\ufffd\ufffd[\ufffd&HlC0\ufffd\ufffd\rV\ufffdE(\ufffdWW)v\ufffd\u001d\b\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000-\u0000\u0002\u0001",
"tls_ja3": "e7cb6fa2d86a78c3ecdcdbaba042490f",
"tls_ja4": "a25e1ff9dd19d6efff5dbeaafce321c2",
"port": 8090,
"service": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090"
},
"evidence_snippet": "\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffdy\ufffd9\ufffd\ufffd\ufffd\ufffd#\u04e6hi\ufffd\ufffdn.\ufffd\u0278i\ufffdk>\ufffdh\ufffd \ufffdI\ufffdf]\ufffd5\ufffd\ufffd[\ufffd&HlC0\ufffd\ufffd\rV\ufffdE(\ufffdWW)v\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+\n-",
"attack_vector": "http-alt-8090 \u00b7 via HTTP ALT 8090:8090 \u00b7 (sonde \/ probe)",
"target_port_label": "8090 \u00b7 HTTP ALT 8090",
"emulator_service": "http-alt-8090",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"pat-0768"
],
"tags_summary_labels_fr": [
"pat-0768"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8090",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00034\ufffd\ufffd\ufffd\ufffdy\ufffd9\ufffd\ufffd\ufffd\ufffd#\u04e6hi\ufffd\u0006\ufffdn.\ufffd\u0278i\ufffdk>\ufffdh\ufffd \ufffdI\ufffdf]\ufffd5\ufffd\ufffd[\ufffd&HlC0\ufffd\ufffd\rV\ufffdE(\ufffdWW)v\ufffd\u001d\b\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000-\u0000\u0002\u0001",
"tls_ja3": "e7cb6fa2d86a78c3ecdcdbaba042490f",
"tls_ja4": "a25e1ff9dd19d6efff5dbeaafce321c2",
"port": 8090,
"service": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090"
},
"attack_vector": "http-alt-8090 \u00b7 via HTTP ALT 8090:8090 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffdy\ufffd9\ufffd\ufffd\ufffd\ufffd#\u04e6hi\ufffd\ufffdn.\ufffd\u0278i\ufffdk>\ufffdh\ufffd \ufffdI\ufffdf]\ufffd5\ufffd\ufffd[\ufffd&HlC0\ufffd\ufffd\rV\ufffdE(\ufffdWW)v\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+\n-",
"target_port_label": "8090 \u00b7 HTTP ALT 8090",
"emulator_service": "http-alt-8090",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8090",
"service_banner": "honeypot-http-alt-8090",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP ALT 8090
|
http-alt-8090
|
http-alt-8090
http-alt-8090 · via HTTP ALT 8090:8090 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 9f89b6649ec29133
Émulateur
HTTP-ALT-8090
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8090
Chemin / cible
—
Service
HTTP ALT 8090
Payload
� ��COR;��]u��S��X�y�ޔC*&$StU �� �u�s��k̏�L��1R��{Zq�m,9Wʻ/ �,�+̩�0�/̨ � � - #
Pourquoi cette classification : Type « http-alt-8090 » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��COR;��]u��S��X�y�ޔC*&$StU �� �u�s��k̏�L��1R��{Zq�m,9Wʻ/ �,�+̩�0�/̨ � � - #
Requête brute (extrait)
� ��COR;��]u��S��X�y�ޔC*&$StU �� �u�s��k̏�L��1R��{Zq�m,9Wʻ/ �,�+̩�0�/̨ � � - # + http/1.1 3 & $ N�[��&��M7A ��TI�G(S`W<�>7'd)
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 241,
"payload_entropy": 5.885877870483124,
"port_category": "registered",
"org": "Google LLC",
"service": "http-alt-8090",
"app_proto": "http-alt-8090",
"asn": 396982,
"country": "JP",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "fc06c824df4a804d476b0e89a599ce8d4ad2c0c4",
"event_fingerprint": "73de1024b23993e40693db328fc9a5b5266e5167",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "http-alt-8090",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d960a2bdaad073ab946dea9a8c096fe6",
"path_pattern_hash": "ced820066cc8b42921bb5be056af57a9",
"ja3": "9f89b6649ec291334f5b88629847cb8f",
"ja4": "fa7bd5ac0bb89f9135c76b1319a629bf",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "9f89b6649ec291334f5b88629847cb8f",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,5-45-23-35-13-10-11-43-16-51,29-23-24,0",
"tls_ja4_hash": "fa7bd5ac0bb89f9135c76b1319a629bf",
"tls_ja4": "t13d0110_2803008b5dc7_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8090,
"service": "http-alt-8090",
"service_name": "http-alt-8090",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0013COR;\ufffd\ufffd]\u0003u\ufffd\ufffdS\ufffd\ufffdX\u0003\ufffdy\ufffd\u0012\u0794C*&$StU \ufffd\ufffd\u001f\ufffdu\ufffds\ufffd\ufffdk\u030f\ufffdL\ufffd\ufffd1R\ufffd\ufffd{\u0005Zq\ufffdm,9W\u02bb\/\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\u0017\u0000\u0000\u0000#\u0000\u0000\u0000\r\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0013COR;\ufffd\ufffd]\u0003u\ufffd\ufffdS\ufffd\ufffdX\u0003\ufffdy\ufffd\u0012\u0794C*&$StU \ufffd\ufffd\u001f\ufffdu\ufffds\ufffd\ufffdk\u030f\ufffdL\ufffd\ufffd1R\ufffd\ufffd{\u0005Zq\ufffdm,9W\u02bb\/\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\u0017\u0000\u0000\u0000#\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u00003\u0000&\u0000$\u0000\u001d\u0000 N\ufffd[\ufffd\u0002\ufffd&\ufffd\ufffdM7A\u001e\ufffd\ufffdTI\ufffdG(S`W<\ufffd>7'd)",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0013COR;\ufffd\ufffd]\u0003u\ufffd\ufffdS\ufffd\ufffdX\u0003\ufffdy\ufffd\u0012\u0794C*&$StU \ufffd\ufffd\u001f\ufffdu\ufffds\ufffd\ufffdk\u030f\ufffdL\ufffd\ufffd1R\ufffd\ufffd{\u0005Zq\ufffdm,9W\u02bb\/\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\u0017\u0000\u0000\u0000#\u0000\u0000\u0000\r\u0000",
"classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ad4fdfaca3ec3f1d9e4c01b8c653dd992fb5ff67",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0013COR;\ufffd\ufffd]\u0003u\ufffd\ufffdS\ufffd\ufffdX\u0003\ufffdy\ufffd\u0012\u0794C*&$StU \ufffd\ufffd\u001f\ufffdu\ufffds\ufffd\ufffdk\u030f\ufffdL\ufffd\ufffd1R\ufffd\ufffd{\u0005Zq\ufffdm,9W\u02bb\/\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\u0017\u0000\u0000\u0000#\u0000\u0000\u0000\r\u0000",
"tls_ja3": "9f89b6649ec291334f5b88629847cb8f",
"tls_ja4": "fa7bd5ac0bb89f9135c76b1319a629bf",
"port": 8090,
"service": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090"
},
"evidence_snippet": "\ufffd\ufffd\ufffdCOR;\ufffd\ufffd]u\ufffd\ufffdS\ufffd\ufffdX\ufffdy\ufffd\u0794C*&$StU \ufffd\ufffd\ufffdu\ufffds\ufffd\ufffdk\u030f\ufffdL\ufffd\ufffd1R\ufffd\ufffd{Zq\ufffdm,9W\u02bb\/\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-#",
"attack_vector": "http-alt-8090 \u00b7 via HTTP ALT 8090:8090 \u00b7 (sonde \/ probe)",
"target_port_label": "8090 \u00b7 HTTP ALT 8090",
"emulator_service": "http-alt-8090",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8090",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0013COR;\ufffd\ufffd]\u0003u\ufffd\ufffdS\ufffd\ufffdX\u0003\ufffdy\ufffd\u0012\u0794C*&$StU \ufffd\ufffd\u001f\ufffdu\ufffds\ufffd\ufffdk\u030f\ufffdL\ufffd\ufffd1R\ufffd\ufffd{\u0005Zq\ufffdm,9W\u02bb\/\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\u0017\u0000\u0000\u0000#\u0000\u0000\u0000\r\u0000",
"tls_ja3": "9f89b6649ec291334f5b88629847cb8f",
"tls_ja4": "fa7bd5ac0bb89f9135c76b1319a629bf",
"port": 8090,
"service": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090"
},
"attack_vector": "http-alt-8090 \u00b7 via HTTP ALT 8090:8090 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdCOR;\ufffd\ufffd]u\ufffd\ufffdS\ufffd\ufffdX\ufffdy\ufffd\u0794C*&$StU \ufffd\ufffd\ufffdu\ufffds\ufffd\ufffdk\u030f\ufffdL\ufffd\ufffd1R\ufffd\ufffd{Zq\ufffdm,9W\u02bb\/\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-#",
"target_port_label": "8090 \u00b7 HTTP ALT 8090",
"emulator_service": "http-alt-8090",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8090",
"service_banner": "honeypot-http-alt-8090",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP ALT 8090
|
http-alt-8090
|
http-alt-8090
http-alt-8090 · via HTTP ALT 8090:8090 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c69307775373a516
Émulateur
HTTP-ALT-8090
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8090
Chemin / cible
—
Service
HTTP ALT 8090
Payload
� ��; iYI�t��� �^��n����"�9 [� ��*ͺ� ģ˦AI@'^ h�YU��;����u �,�+̩�0�/̨ � �
Pourquoi cette classification : Type « http-alt-8090 » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��; iYI�t��� �^��n����"�9 [� ��*ͺ� ģ˦AI@'^ h�YU��;����u �,�+̩�0�/̨ � �
Requête brute (extrait)
� ��; iYI�t��� �^��n����"�9 [� ��*ͺ� ģ˦AI@'^ h�YU��;����u �,�+̩�0�/̨ � � + 3 & $ �K��IhAh(���T<�!]s.\&� �]GY # http/1.1 -
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 241,
"payload_entropy": 5.800438704394888,
"port_category": "registered",
"org": "Google LLC",
"service": "http-alt-8090",
"app_proto": "http-alt-8090",
"asn": 396982,
"country": "JP",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "fc06c824df4a804d476b0e89a599ce8d4ad2c0c4",
"event_fingerprint": "73de1024b23993e40693db328fc9a5b5266e5167",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "http-alt-8090",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9745fbe4480bc5e13f250ecc15c21862",
"path_pattern_hash": "ced820066cc8b42921bb5be056af57a9",
"ja3": "c69307775373a5162698d99c6c22d12d",
"ja4": "061f8d27a3f31dce99ea0a13bfced114",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "c69307775373a5162698d99c6c22d12d",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,13-10-43-51-35-11-5-16-23-45,29-23-24,0",
"tls_ja4_hash": "061f8d27a3f31dce99ea0a13bfced114",
"tls_ja4": "t13d0110_de91ef0af452_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8090,
"service": "http-alt-8090",
"service_name": "http-alt-8090",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0012\ufffd; \u0000iYI\ufffd\u0010t\ufffd\ufffd\ufffd\u000b\ufffd\b^\ufffd\ufffdn\ufffd\ufffd\ufffd\ufffd\"\ufffd9\u001c[\ufffd \ufffd\ufffd*\u0002\u037a\ufffd\u0005\u001c\u0123\u02e6AI@'^\u000bh\ufffdYU\ufffd\u0002\ufffd;\ufffd\ufffd\ufffd\ufffdu\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0012\ufffd; \u0000iYI\ufffd\u0010t\ufffd\ufffd\ufffd\u000b\ufffd\b^\ufffd\ufffdn\ufffd\ufffd\ufffd\ufffd\"\ufffd9\u001c[\ufffd \ufffd\ufffd*\u0002\u037a\ufffd\u0005\u001c\u0123\u02e6AI@'^\u000bh\ufffdYU\ufffd\u0002\ufffd;\ufffd\ufffd\ufffd\ufffdu\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \u000f\ufffdK\ufffd\ufffdIhAh(\ufffd\ufffd\ufffdT<\ufffd\u0001!\u0010]s.\\\u0018&\ufffd\u001e\ufffd]GY\f\u0000#\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0017\u0000\u0000\u0000-\u0000\u0002\u0001\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0012\ufffd; \u0000iYI\ufffd\u0010t\ufffd\ufffd\ufffd\u000b\ufffd\b^\ufffd\ufffdn\ufffd\ufffd\ufffd\ufffd\"\ufffd9\u001c[\ufffd \ufffd\ufffd*\u0002\u037a\ufffd\u0005\u001c\u0123\u02e6AI@'^\u000bh\ufffdYU\ufffd\u0002\ufffd;\ufffd\ufffd\ufffd\ufffdu\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "02596b0f74eb25707a809c4b5d20408d0bc43ee6",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0012\ufffd; \u0000iYI\ufffd\u0010t\ufffd\ufffd\ufffd\u000b\ufffd\b^\ufffd\ufffdn\ufffd\ufffd\ufffd\ufffd\"\ufffd9\u001c[\ufffd \ufffd\ufffd*\u0002\u037a\ufffd\u0005\u001c\u0123\u02e6AI@'^\u000bh\ufffdYU\ufffd\u0002\ufffd;\ufffd\ufffd\ufffd\ufffdu\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"tls_ja3": "c69307775373a5162698d99c6c22d12d",
"tls_ja4": "061f8d27a3f31dce99ea0a13bfced114",
"port": 8090,
"service": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090"
},
"evidence_snippet": "\ufffd\ufffd\ufffd; iYI\ufffdt\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffdn\ufffd\ufffd\ufffd\ufffd\"\ufffd9[\ufffd \ufffd\ufffd*\u037a\ufffd\u0123\u02e6AI@'^h\ufffdYU\ufffd\ufffd;\ufffd\ufffd\ufffd\ufffdu\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"attack_vector": "http-alt-8090 \u00b7 via HTTP ALT 8090:8090 \u00b7 (sonde \/ probe)",
"target_port_label": "8090 \u00b7 HTTP ALT 8090",
"emulator_service": "http-alt-8090",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8090",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0012\ufffd; \u0000iYI\ufffd\u0010t\ufffd\ufffd\ufffd\u000b\ufffd\b^\ufffd\ufffdn\ufffd\ufffd\ufffd\ufffd\"\ufffd9\u001c[\ufffd \ufffd\ufffd*\u0002\u037a\ufffd\u0005\u001c\u0123\u02e6AI@'^\u000bh\ufffdYU\ufffd\u0002\ufffd;\ufffd\ufffd\ufffd\ufffdu\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"tls_ja3": "c69307775373a5162698d99c6c22d12d",
"tls_ja4": "061f8d27a3f31dce99ea0a13bfced114",
"port": 8090,
"service": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090"
},
"attack_vector": "http-alt-8090 \u00b7 via HTTP ALT 8090:8090 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd; iYI\ufffdt\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffdn\ufffd\ufffd\ufffd\ufffd\"\ufffd9[\ufffd \ufffd\ufffd*\u037a\ufffd\u0123\u02e6AI@'^h\ufffdYU\ufffd\ufffd;\ufffd\ufffd\ufffd\ufffdu\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"target_port_label": "8090 \u00b7 HTTP ALT 8090",
"emulator_service": "http-alt-8090",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8090",
"service_banner": "honeypot-http-alt-8090",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP ALT 8090
|
http-alt-8090
|
http-alt-8090
http-alt-8090 · via HTTP ALT 8090:8090 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 75f8d0cc51a3638b
Émulateur
HTTP-ALT-8090
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8090
Chemin / cible
—
Service
HTTP ALT 8090
Payload
� ��L���)Є�q�$J���\kM�H: �` ���G.� {-�D�V����k2��_Y�W��f �,�+̩�0�/̨ � �
Pourquoi cette classification : Type « http-alt-8090 » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��L���)Є�q�$J���\kM�H: �` ���G.�
{-�D�V����k2��_Y�W��f �,�+̩�0�/̨ � �
Requête brute (extrait)
� ��L���)Є�q�$J���\kM�H: �` ���G.� {-�D�V����k2��_Y�W��f �,�+̩�0�/̨ � � 3 & $ ���#�!��ɝHq`wP�%5��ǐ�<:��C3 + http/1.1 # -
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 241,
"payload_entropy": 5.900242509757148,
"port_category": "registered",
"org": "Google LLC",
"service": "http-alt-8090",
"app_proto": "http-alt-8090",
"asn": 396982,
"country": "JP",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "fc06c824df4a804d476b0e89a599ce8d4ad2c0c4",
"event_fingerprint": "73de1024b23993e40693db328fc9a5b5266e5167",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "http-alt-8090",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "06ff6058017c246d865a9e321eb343aa",
"path_pattern_hash": "ced820066cc8b42921bb5be056af57a9",
"ja3": "75f8d0cc51a3638bf94c974e218a0048",
"ja4": "651df11977925c0b08721dd7558fee20",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "75f8d0cc51a3638bf94c974e218a0048",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,13-51-43-11-16-10-35-23-5-45,29-23-24,0",
"tls_ja4_hash": "651df11977925c0b08721dd7558fee20",
"tls_ja4": "t13d0110_aa56a54ffc2d_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8090,
"service": "http-alt-8090",
"service_name": "http-alt-8090",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdL\ufffd\ufffd\ufffd\u0010)\u0404\ufffdq\ufffd$J\ufffd\ufffd\ufffd\\k\u0019M\ufffdH\u001a:\u0014\f\t\ufffd\u0017`\u001b \ufffd\ufffd\ufffdG.\ufffd\u001c\r{-\u000f\ufffdD\ufffdV\u0004\ufffd\ufffd\ufffd\ufffdk2\ufffd\ufffd_Y\ufffdW\ufffd\ufffdf\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdL\ufffd\ufffd\ufffd\u0010)\u0404\ufffdq\ufffd$J\ufffd\ufffd\ufffd\\k\u0019M\ufffdH\u001a:\u0014\f\t\ufffd\u0017`\u001b \ufffd\ufffd\ufffdG.\ufffd\u001c\r{-\u000f\ufffdD\ufffdV\u0004\ufffd\ufffd\ufffd\ufffdk2\ufffd\ufffd_Y\ufffdW\ufffd\ufffdf\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u0005\ufffd\ufffd#\ufffd!\ufffd\u0010\ufffd\u025dHq`wP\ufffd%5\ufffd\ufffd\u01d0\ufffd<:\ufffd\u0006\ufffdC3\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdL\ufffd\ufffd\ufffd\u0010)\u0404\ufffdq\ufffd$J\ufffd\ufffd\ufffd\\k\u0019M\ufffdH\u001a:\u0014\f\t\ufffd\u0017`\u001b \ufffd\ufffd\ufffdG.\ufffd\u001c\r{-\u000f\ufffdD\ufffdV\u0004\ufffd\ufffd\ufffd\ufffdk2\ufffd\ufffd_Y\ufffdW\ufffd\ufffdf\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "112c6e24746407bd4e2a073e9d580daab29b1312",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdL\ufffd\ufffd\ufffd\u0010)\u0404\ufffdq\ufffd$J\ufffd\ufffd\ufffd\\k\u0019M\ufffdH\u001a:\u0014\f\t\ufffd\u0017`\u001b \ufffd\ufffd\ufffdG.\ufffd\u001c\r{-\u000f\ufffdD\ufffdV\u0004\ufffd\ufffd\ufffd\ufffdk2\ufffd\ufffd_Y\ufffdW\ufffd\ufffdf\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"tls_ja3": "75f8d0cc51a3638bf94c974e218a0048",
"tls_ja4": "651df11977925c0b08721dd7558fee20",
"port": 8090,
"service": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090"
},
"evidence_snippet": "\ufffd\ufffd\ufffdL\ufffd\ufffd\ufffd)\u0404\ufffdq\ufffd$J\ufffd\ufffd\ufffd\\kM\ufffdH:\t\ufffd` \ufffd\ufffd\ufffdG.\ufffd\r{-\ufffdD\ufffdV\ufffd\ufffd\ufffd\ufffdk2\ufffd\ufffd_Y\ufffdW\ufffd\ufffdf\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"attack_vector": "http-alt-8090 \u00b7 via HTTP ALT 8090:8090 \u00b7 (sonde \/ probe)",
"target_port_label": "8090 \u00b7 HTTP ALT 8090",
"emulator_service": "http-alt-8090",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8090",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdL\ufffd\ufffd\ufffd\u0010)\u0404\ufffdq\ufffd$J\ufffd\ufffd\ufffd\\k\u0019M\ufffdH\u001a:\u0014\f\t\ufffd\u0017`\u001b \ufffd\ufffd\ufffdG.\ufffd\u001c\r{-\u000f\ufffdD\ufffdV\u0004\ufffd\ufffd\ufffd\ufffdk2\ufffd\ufffd_Y\ufffdW\ufffd\ufffdf\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"tls_ja3": "75f8d0cc51a3638bf94c974e218a0048",
"tls_ja4": "651df11977925c0b08721dd7558fee20",
"port": 8090,
"service": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090"
},
"attack_vector": "http-alt-8090 \u00b7 via HTTP ALT 8090:8090 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdL\ufffd\ufffd\ufffd)\u0404\ufffdq\ufffd$J\ufffd\ufffd\ufffd\\kM\ufffdH:\t\ufffd` \ufffd\ufffd\ufffdG.\ufffd\r{-\ufffdD\ufffdV\ufffd\ufffd\ufffd\ufffdk2\ufffd\ufffd_Y\ufffdW\ufffd\ufffdf\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"target_port_label": "8090 \u00b7 HTTP ALT 8090",
"emulator_service": "http-alt-8090",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8090",
"service_banner": "honeypot-http-alt-8090",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP ALT 8090
|
http-alt-8090
|
Sonde PostgreSQL
postgres probe · via HTTP ALT 8090:8090 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 4c37039ab2b9ba6f
Émulateur
HTTP-ALT-8090
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8090
Chemin / cible
—
Service
HTTP ALT 8090
Payload
� �c�������"�� x���Xͭ �ת0�/?P# �����p�~��^�� � �@��q���r!�,� �,�+̩�0�/̨ � � 3 & $ �7����L� �,g7
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Mumble ping
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� �c�������"��
x���Xͭ �ת0�/?P# �����p�~��^�� � �@��q���r!�,� �,�+̩�0�/̨ � � 3 & $ �7����L� �,g7
Requête brute (extrait)
� �c�������"�� x���Xͭ �ת0�/?P# �����p�~��^�� � �@��q���r!�,� �,�+̩�0�/̨ � � 3 & $ �7����L� �,g7�m� *f�f�i ]�yI http/1.1 + # -
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 241,
"payload_entropy": 5.854966507531568,
"port_category": "registered",
"org": "Google LLC",
"service": "http-alt-8090",
"app_proto": "http-alt-8090",
"asn": 396982,
"country": "JP",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "fc06c824df4a804d476b0e89a599ce8d4ad2c0c4",
"event_fingerprint": "73de1024b23993e40693db328fc9a5b5266e5167",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0768",
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Mumble ping",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0369",
"pat-0768",
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "http-alt-8090",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b5b27d399a1feef7058d728e19af83e3",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "4c37039ab2b9ba6f0ce4c06c54ec319f",
"ja4": "caf755ac812c4d8d5d3efec1e8b7c9eb",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "4c37039ab2b9ba6f0ce4c06c54ec319f",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,51-23-16-43-35-10-11-45-13-5,29-23-24,0",
"tls_ja4_hash": "caf755ac812c4d8d5d3efec1e8b7c9eb",
"tls_ja4": "t13d0110_9a8546ecddb1_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8090,
"service": "http-alt-8090",
"service_name": "http-alt-8090",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0006c\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\nx\ufffd\ufffd\ufffdX\u036d\t\ufffd\u05ea0\ufffd\/?P\u0003#\u001f \ufffd\ufffd\ufffd\ufffd\ufffdp\ufffd~\ufffd\ufffd^\ufffd\u0005\ufffd\f\ufffd\u001d\ufffd\u0010\u0013@\ufffd\ufffdq\ufffd\ufffd\ufffdr!\ufffd,\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd7\ufffd\ufffd\ufffd\u0004\u0012\ufffdL\ufffd\u0000\ufffd,\u0004g7",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0006c\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\nx\ufffd\ufffd\ufffdX\u036d\t\ufffd\u05ea0\ufffd\/?P\u0003#\u001f \ufffd\ufffd\ufffd\ufffd\ufffdp\ufffd~\ufffd\ufffd^\ufffd\u0005\ufffd\f\ufffd\u001d\ufffd\u0010\u0013@\ufffd\ufffdq\ufffd\ufffd\ufffdr!\ufffd,\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd7\ufffd\ufffd\ufffd\u0004\u0012\ufffdL\ufffd\u0000\ufffd,\u0004g7\ufffdm\ufffd\u0000\u0014*f\ufffdf\ufffdi\u001f]\ufffdyI\u0000\u0017\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000#\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0006c\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\nx\ufffd\ufffd\ufffdX\u036d\t\ufffd\u05ea0\ufffd\/?P\u0003#\u001f \ufffd\ufffd\ufffd\ufffd\ufffdp\ufffd~\ufffd\ufffd^\ufffd\u0005\ufffd\f\ufffd\u001d\ufffd\u0010\u0013@\ufffd\ufffdq\ufffd\ufffd\ufffdr!\ufffd,\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd7\ufffd\ufffd\ufffd\u0004\u0012\ufffdL\ufffd\u0000\ufffd,\u0004g7",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "884b1a5c5ce37d504a366af87a574c5d57697d98",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0006c\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\nx\ufffd\ufffd\ufffdX\u036d\t\ufffd\u05ea0\ufffd\/?P\u0003#\u001f \ufffd\ufffd\ufffd\ufffd\ufffdp\ufffd~\ufffd\ufffd^\ufffd\u0005\ufffd\f\ufffd\u001d\ufffd\u0010\u0013@\ufffd\ufffdq\ufffd\ufffd\ufffdr!\ufffd,\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd7\ufffd\ufffd\ufffd\u0004\u0012\ufffdL\ufffd\u0000\ufffd,\u0004g7",
"tls_ja3": "4c37039ab2b9ba6f0ce4c06c54ec319f",
"tls_ja4": "caf755ac812c4d8d5d3efec1e8b7c9eb",
"port": 8090,
"service": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090"
},
"evidence_snippet": "\ufffd\ufffdc\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\nx\ufffd\ufffd\ufffdX\u036d\t\ufffd\u05ea0\ufffd\/?P# \ufffd\ufffd\ufffd\ufffd\ufffdp\ufffd~\ufffd\ufffd^\ufffd\ufffd\ufffd\ufffd@\ufffd\ufffdq\ufffd\ufffd\ufffdr!\ufffd,\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3&$ \ufffd7\ufffd\ufffd\ufffd\ufffdL\ufffd\ufffd,g7",
"attack_vector": "postgres probe \u00b7 via HTTP ALT 8090:8090 \u00b7 (sonde \/ probe)",
"target_port_label": "8090 \u00b7 HTTP ALT 8090",
"emulator_service": "http-alt-8090",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8090",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0006c\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\nx\ufffd\ufffd\ufffdX\u036d\t\ufffd\u05ea0\ufffd\/?P\u0003#\u001f \ufffd\ufffd\ufffd\ufffd\ufffdp\ufffd~\ufffd\ufffd^\ufffd\u0005\ufffd\f\ufffd\u001d\ufffd\u0010\u0013@\ufffd\ufffdq\ufffd\ufffd\ufffdr!\ufffd,\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd7\ufffd\ufffd\ufffd\u0004\u0012\ufffdL\ufffd\u0000\ufffd,\u0004g7",
"tls_ja3": "4c37039ab2b9ba6f0ce4c06c54ec319f",
"tls_ja4": "caf755ac812c4d8d5d3efec1e8b7c9eb",
"port": 8090,
"service": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090"
},
"attack_vector": "postgres probe \u00b7 via HTTP ALT 8090:8090 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdc\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\nx\ufffd\ufffd\ufffdX\u036d\t\ufffd\u05ea0\ufffd\/?P# \ufffd\ufffd\ufffd\ufffd\ufffdp\ufffd~\ufffd\ufffd^\ufffd\ufffd\ufffd\ufffd@\ufffd\ufffdq\ufffd\ufffd\ufffdr!\ufffd,\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3&$ \ufffd7\ufffd\ufffd\ufffd\ufffdL\ufffd\ufffd,g7",
"target_port_label": "8090 \u00b7 HTTP ALT 8090",
"emulator_service": "http-alt-8090",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8090",
"service_banner": "honeypot-http-alt-8090",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP ALT 8090
|
http-alt-8090
|
Sonde PostgreSQL
postgres probe · via HTTP ALT 8090:8090 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 f6d8058e4c0018ed
Émulateur
HTTP-ALT-8090
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8090
Chemin / cible
—
Service
HTTP ALT 8090
Payload
� �J0��:�[$h�;aLǘWQ��@[:�"X;�(˺� � 0��<f # ��5MTVO��Ji1�X�}m� �,�+̩�0�/̨ � �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� �J0��:�[$h�;aLǘWQ��@[:�"X;�(˺� � 0��<f # ��5MTVO��Ji1�X�}m� �,�+̩�0�/̨ � �
Requête brute (extrait)
� �J0��:�[$h�;aLǘWQ��@[:�"X;�(˺� � 0��<f # ��5MTVO��Ji1�X�}m� �,�+̩�0�/̨ � � - + http/1.1 # 3 & $ Z rZ���g$�z ҄Ӊ�.=��>�ըT
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 241,
"payload_entropy": 5.864375157692152,
"port_category": "registered",
"org": "Google LLC",
"service": "http-alt-8090",
"app_proto": "http-alt-8090",
"asn": 396982,
"country": "JP",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "fc06c824df4a804d476b0e89a599ce8d4ad2c0c4",
"event_fingerprint": "73de1024b23993e40693db328fc9a5b5266e5167",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "http-alt-8090",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a6870911b38646475634b0acd200de38",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "f6d8058e4c0018ed0447fb7c4dfa2aa6",
"ja4": "ca5aa29569ebd8dd967652ad8822de4b",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "f6d8058e4c0018ed0447fb7c4dfa2aa6",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,23-5-10-45-13-43-11-16-35-51,29-23-24,0",
"tls_ja4_hash": "ca5aa29569ebd8dd967652ad8822de4b",
"tls_ja4": "t13d0110_51ea9ce16fc5_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8090,
"service": "http-alt-8090",
"service_name": "http-alt-8090",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003J0\ufffd\u0017\ufffd:\ufffd[$h\ufffd;aL\u01d8WQ\ufffd\ufffd@[:\ufffd\"X;\ufffd(\u02fa\ufffd \ufffd\u000b0\ufffd\ufffd<f\u0000#\u001d\ufffd\ufffd5MT\u0017VO\ufffd\u0012\ufffdJi1\ufffdX\ufffd}m\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003J0\ufffd\u0017\ufffd:\ufffd[$h\ufffd;aL\u01d8WQ\ufffd\ufffd@[:\ufffd\"X;\ufffd(\u02fa\ufffd \ufffd\u000b0\ufffd\ufffd<f\u0000#\u001d\ufffd\ufffd5MT\u0017VO\ufffd\u0012\ufffdJi1\ufffdX\ufffd}m\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000-\u0000\u0002\u0001\u0001\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000#\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0018Z\u000f\u0013\u001erZ\ufffd\ufffd\ufffdg$\ufffdz\n\u0484\u0012\u04c9\ufffd.=\ufffd\ufffd\u0002>\ufffd\u0568\u0016T",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003J0\ufffd\u0017\ufffd:\ufffd[$h\ufffd;aL\u01d8WQ\ufffd\ufffd@[:\ufffd\"X;\ufffd(\u02fa\ufffd \ufffd\u000b0\ufffd\ufffd<f\u0000#\u001d\ufffd\ufffd5MT\u0017VO\ufffd\u0012\ufffdJi1\ufffdX\ufffd}m\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d010bbed46bbf45793c15b9468b11b9e4d88e1c8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003J0\ufffd\u0017\ufffd:\ufffd[$h\ufffd;aL\u01d8WQ\ufffd\ufffd@[:\ufffd\"X;\ufffd(\u02fa\ufffd \ufffd\u000b0\ufffd\ufffd<f\u0000#\u001d\ufffd\ufffd5MT\u0017VO\ufffd\u0012\ufffdJi1\ufffdX\ufffd}m\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"tls_ja3": "f6d8058e4c0018ed0447fb7c4dfa2aa6",
"tls_ja4": "ca5aa29569ebd8dd967652ad8822de4b",
"port": 8090,
"service": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090"
},
"evidence_snippet": "\ufffd\ufffdJ0\ufffd\ufffd:\ufffd[$h\ufffd;aL\u01d8WQ\ufffd\ufffd@[:\ufffd\"X;\ufffd(\u02fa\ufffd \ufffd0\ufffd\ufffd<f#\ufffd\ufffd5MTVO\ufffd\ufffdJi1\ufffdX\ufffd}m\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via HTTP ALT 8090:8090 \u00b7 (sonde \/ probe)",
"target_port_label": "8090 \u00b7 HTTP ALT 8090",
"emulator_service": "http-alt-8090",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8090",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003J0\ufffd\u0017\ufffd:\ufffd[$h\ufffd;aL\u01d8WQ\ufffd\ufffd@[:\ufffd\"X;\ufffd(\u02fa\ufffd \ufffd\u000b0\ufffd\ufffd<f\u0000#\u001d\ufffd\ufffd5MT\u0017VO\ufffd\u0012\ufffdJi1\ufffdX\ufffd}m\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"tls_ja3": "f6d8058e4c0018ed0447fb7c4dfa2aa6",
"tls_ja4": "ca5aa29569ebd8dd967652ad8822de4b",
"port": 8090,
"service": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090"
},
"attack_vector": "postgres probe \u00b7 via HTTP ALT 8090:8090 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdJ0\ufffd\ufffd:\ufffd[$h\ufffd;aL\u01d8WQ\ufffd\ufffd@[:\ufffd\"X;\ufffd(\u02fa\ufffd \ufffd0\ufffd\ufffd<f#\ufffd\ufffd5MTVO\ufffd\ufffdJi1\ufffdX\ufffd}m\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"target_port_label": "8090 \u00b7 HTTP ALT 8090",
"emulator_service": "http-alt-8090",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8090",
"service_banner": "honeypot-http-alt-8090",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP ALT 8090
|
http-alt-8090
|
Sonde PostgreSQL
postgres probe · via HTTP ALT 8090:8090 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 77b41cff1a473038
Émulateur
HTTP-ALT-8090
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8090
Chemin / cible
—
Service
HTTP ALT 8090
Payload
� ���i����T�E,�6篣Tm�dԽ�u�N�V� cm־��t`x?�s: `�֠s1�B����˜ �,�+̩�0�/̨ � � - 3 & $ �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���i����T�E,�6篣Tm�dԽ�u�N�V� cm־��t`x?�s: `�֠s1�B����˜ �,�+̩�0�/̨ � � - 3 & $ �
Requête brute (extrait)
� ���i����T�E,�6篣Tm�dԽ�u�N�V� cm־��t`x?�s: `�֠s1�B����˜ �,�+̩�0�/̨ � � - 3 & $ �Z���E�625��/Q��Cs�LSφo GGi + # http/1.1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 241,
"payload_entropy": 5.8815865933198195,
"port_category": "registered",
"org": "Google LLC",
"service": "http-alt-8090",
"app_proto": "http-alt-8090",
"asn": 396982,
"country": "JP",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "fc06c824df4a804d476b0e89a599ce8d4ad2c0c4",
"event_fingerprint": "73de1024b23993e40693db328fc9a5b5266e5167",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "http-alt-8090",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7737de498fc3aecbe969de1b42cfa200",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "77b41cff1a4730385c8f01b3f4aecbce",
"ja4": "35b002f76af609a35acaa08867e5970c",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "77b41cff1a4730385c8f01b3f4aecbce",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,5-45-51-11-43-35-13-16-23-10,29-23-24,0",
"tls_ja4_hash": "35b002f76af609a35acaa08867e5970c",
"tls_ja4": "t13d0110_0d24e3abe76f_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8090,
"service": "http-alt-8090",
"service_name": "http-alt-8090",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u000fi\ufffd\ufffd\ufffd\ufffdT\ufffdE,\ufffd6\u7be3Tm\ufffdd\u053d\ufffdu\u0013\ufffdN\ufffdV\ufffd \u0004cm\u05be\u0010\ufffd\ufffdt`x?\ufffds:\u001e`\ufffd\u05a0s1\ufffdB\ufffd\ufffd\ufffd\u0001\u0017\ufffd\u02dc\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u000fi\ufffd\ufffd\ufffd\ufffdT\ufffdE,\ufffd6\u7be3Tm\ufffdd\u053d\ufffdu\u0013\ufffdN\ufffdV\ufffd \u0004cm\u05be\u0010\ufffd\ufffdt`x?\ufffds:\u001e`\ufffd\u05a0s1\ufffdB\ufffd\ufffd\ufffd\u0001\u0017\ufffd\u02dc\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdZ\ufffd\ufffd\ufffdE\ufffd625\u0004\ufffd\u001a\ufffd\/Q\ufffd\ufffd\u0011Cs\ufffdLS\u03c6o\u001fGGi\r\u0000\u000b\u0000\u0002\u0001\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000#\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0017\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u000fi\ufffd\ufffd\ufffd\ufffdT\ufffdE,\ufffd6\u7be3Tm\ufffdd\u053d\ufffdu\u0013\ufffdN\ufffdV\ufffd \u0004cm\u05be\u0010\ufffd\ufffdt`x?\ufffds:\u001e`\ufffd\u05a0s1\ufffdB\ufffd\ufffd\ufffd\u0001\u0017\ufffd\u02dc\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "47913374142884c1c0cedcf5e6620c42b884e624",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u000fi\ufffd\ufffd\ufffd\ufffdT\ufffdE,\ufffd6\u7be3Tm\ufffdd\u053d\ufffdu\u0013\ufffdN\ufffdV\ufffd \u0004cm\u05be\u0010\ufffd\ufffdt`x?\ufffds:\u001e`\ufffd\u05a0s1\ufffdB\ufffd\ufffd\ufffd\u0001\u0017\ufffd\u02dc\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd",
"tls_ja3": "77b41cff1a4730385c8f01b3f4aecbce",
"tls_ja4": "35b002f76af609a35acaa08867e5970c",
"port": 8090,
"service": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\ufffd\ufffdT\ufffdE,\ufffd6\u7be3Tm\ufffdd\u053d\ufffdu\ufffdN\ufffdV\ufffd cm\u05be\ufffd\ufffdt`x?\ufffds:`\ufffd\u05a0s1\ufffdB\ufffd\ufffd\ufffd\ufffd\u02dc\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-3&$ \ufffd",
"attack_vector": "postgres probe \u00b7 via HTTP ALT 8090:8090 \u00b7 (sonde \/ probe)",
"target_port_label": "8090 \u00b7 HTTP ALT 8090",
"emulator_service": "http-alt-8090",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8090",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u000fi\ufffd\ufffd\ufffd\ufffdT\ufffdE,\ufffd6\u7be3Tm\ufffdd\u053d\ufffdu\u0013\ufffdN\ufffdV\ufffd \u0004cm\u05be\u0010\ufffd\ufffdt`x?\ufffds:\u001e`\ufffd\u05a0s1\ufffdB\ufffd\ufffd\ufffd\u0001\u0017\ufffd\u02dc\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd",
"tls_ja3": "77b41cff1a4730385c8f01b3f4aecbce",
"tls_ja4": "35b002f76af609a35acaa08867e5970c",
"port": 8090,
"service": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090"
},
"attack_vector": "postgres probe \u00b7 via HTTP ALT 8090:8090 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\ufffd\ufffdT\ufffdE,\ufffd6\u7be3Tm\ufffdd\u053d\ufffdu\ufffdN\ufffdV\ufffd cm\u05be\ufffd\ufffdt`x?\ufffds:`\ufffd\u05a0s1\ufffdB\ufffd\ufffd\ufffd\ufffd\u02dc\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-3&$ \ufffd",
"target_port_label": "8090 \u00b7 HTTP ALT 8090",
"emulator_service": "http-alt-8090",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8090",
"service_banner": "honeypot-http-alt-8090",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP ALT 8090
|
http-alt-8090
|
http-alt-8090
http-alt-8090 · via HTTP ALT 8090:8090 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 e833ca37e9a21226
Émulateur
HTTP-ALT-8090
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8090
Chemin / cible
—
Service
HTTP ALT 8090
Payload
� �.�D � I �LtR[��B3��k|щʜ䄮��� \b�6�; &e��ֲ � �%�s����|�td �,�+̩�0�/̨ � � # http/1.1 3 & $
Pourquoi cette classification : Type « http-alt-8090 » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0768
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �.�D � I �LtR[��B3��k|щʜ䄮��� \b�6�; &e��ֲ � �%�s����|�td �,�+̩�0�/̨ � � # http/1.1 3 & $
Requête brute (extrait)
� �.�D � I �LtR[��B3��k|щʜ䄮��� \b�6�; &e��ֲ � �%�s����|�td �,�+̩�0�/̨ � � # http/1.1 3 & $ ��z94����N�y�[��� �&��� d�gu + -
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 241,
"payload_entropy": 5.856147924167589,
"port_category": "registered",
"org": "Google LLC",
"service": "http-alt-8090",
"app_proto": "http-alt-8090",
"asn": 396982,
"country": "JP",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "fc06c824df4a804d476b0e89a599ce8d4ad2c0c4",
"event_fingerprint": "73de1024b23993e40693db328fc9a5b5266e5167",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0768"
],
"classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "http-alt-8090",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "673327d378d2d682455964f8024e6693",
"path_pattern_hash": "ced820066cc8b42921bb5be056af57a9",
"ja3": "e833ca37e9a212265d56e246d82b43b4",
"ja4": "538fd50220412e1a120e5057c3b7eaf8",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "e833ca37e9a212265d56e246d82b43b4",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,35-16-51-23-43-10-11-45-13-5,29-23-24,0",
"tls_ja4_hash": "538fd50220412e1a120e5057c3b7eaf8",
"tls_ja4": "t13d0110_f3cf1c922d93_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8090,
"service": "http-alt-8090",
"service_name": "http-alt-8090",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003.\ufffdD\u001f\ufffd\u001fI\f\ufffdL\u001atR[\ufffd\ufffdB3\ufffd\ufffdk|\u0449\u029c\u412e\ufffd\ufffd\ufffd \\b\ufffd6\ufffd;\u000b&e\ufffd\ufffd\u05b2\u0000\ufffd\u001c\ufffd%\ufffds\u000f\ufffd\ufffd\u001a\ufffd\ufffd|\u0001\u0015\ufffdtd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u00003\u0000&\u0000$\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003.\ufffdD\u001f\ufffd\u001fI\f\ufffdL\u001atR[\ufffd\ufffdB3\ufffd\ufffdk|\u0449\u029c\u412e\ufffd\ufffd\ufffd \\b\ufffd6\ufffd;\u000b&e\ufffd\ufffd\u05b2\u0000\ufffd\u001c\ufffd%\ufffds\u000f\ufffd\ufffd\u001a\ufffd\ufffd|\u0001\u0015\ufffdtd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffdz94\ufffd\u0016\ufffd\ufffd\ufffdN\u0002\ufffdy\ufffd[\ufffd\ufffd\ufffd\u001f\ufffd&\ufffd\ufffd\u0005\ufffd d\ufffdgu\u0000\u0017\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003.\ufffdD\u001f\ufffd\u001fI\f\ufffdL\u001atR[\ufffd\ufffdB3\ufffd\ufffdk|\u0449\u029c\u412e\ufffd\ufffd\ufffd \\b\ufffd6\ufffd;\u000b&e\ufffd\ufffd\u05b2\u0000\ufffd\u001c\ufffd%\ufffds\u000f\ufffd\ufffd\u001a\ufffd\ufffd|\u0001\u0015\ufffdtd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u00003\u0000&\u0000$\u0000",
"classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8556d6e6344511b8c703b91efc711aa6bbe6b0ba",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003.\ufffdD\u001f\ufffd\u001fI\f\ufffdL\u001atR[\ufffd\ufffdB3\ufffd\ufffdk|\u0449\u029c\u412e\ufffd\ufffd\ufffd \\b\ufffd6\ufffd;\u000b&e\ufffd\ufffd\u05b2\u0000\ufffd\u001c\ufffd%\ufffds\u000f\ufffd\ufffd\u001a\ufffd\ufffd|\u0001\u0015\ufffdtd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u00003\u0000&\u0000$\u0000",
"tls_ja3": "e833ca37e9a212265d56e246d82b43b4",
"tls_ja4": "538fd50220412e1a120e5057c3b7eaf8",
"port": 8090,
"service": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090"
},
"evidence_snippet": "\ufffd\ufffd.\ufffdD\ufffdI\ufffdLtR[\ufffd\ufffdB3\ufffd\ufffdk|\u0449\u029c\u412e\ufffd\ufffd\ufffd \\b\ufffd6\ufffd;&e\ufffd\ufffd\u05b2\ufffd\ufffd%\ufffds\ufffd\ufffd\ufffd\ufffd|\ufffdtd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#\thttp\/1.13&$",
"attack_vector": "http-alt-8090 \u00b7 via HTTP ALT 8090:8090 \u00b7 (sonde \/ probe)",
"target_port_label": "8090 \u00b7 HTTP ALT 8090",
"emulator_service": "http-alt-8090",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"pat-0768"
],
"tags_summary_labels_fr": [
"pat-0768"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8090",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003.\ufffdD\u001f\ufffd\u001fI\f\ufffdL\u001atR[\ufffd\ufffdB3\ufffd\ufffdk|\u0449\u029c\u412e\ufffd\ufffd\ufffd \\b\ufffd6\ufffd;\u000b&e\ufffd\ufffd\u05b2\u0000\ufffd\u001c\ufffd%\ufffds\u000f\ufffd\ufffd\u001a\ufffd\ufffd|\u0001\u0015\ufffdtd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000#\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u00003\u0000&\u0000$\u0000",
"tls_ja3": "e833ca37e9a212265d56e246d82b43b4",
"tls_ja4": "538fd50220412e1a120e5057c3b7eaf8",
"port": 8090,
"service": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090"
},
"attack_vector": "http-alt-8090 \u00b7 via HTTP ALT 8090:8090 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd.\ufffdD\ufffdI\ufffdLtR[\ufffd\ufffdB3\ufffd\ufffdk|\u0449\u029c\u412e\ufffd\ufffd\ufffd \\b\ufffd6\ufffd;&e\ufffd\ufffd\u05b2\ufffd\ufffd%\ufffds\ufffd\ufffd\ufffd\ufffd|\ufffdtd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#\thttp\/1.13&$",
"target_port_label": "8090 \u00b7 HTTP ALT 8090",
"emulator_service": "http-alt-8090",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8090",
"service_banner": "honeypot-http-alt-8090",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP ALT 8090
|
http-alt-8090
|
http-alt-8090
http-alt-8090 · via HTTP ALT 8090:8090 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 ae8e71d803bcabe2
Émulateur
HTTP-ALT-8090
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8090
Chemin / cible
—
Service
HTTP ALT 8090
Payload
� ��3%�&���+��8��-�(���8LQ�t� �s�]�>Am Tr��%� 64>*��5ԍ�l_ �,�+̩�0�/̨ � � 3 & $ yE$!�l��glv�sE�
Pourquoi cette classification : Type « http-alt-8090 » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0768
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��3%�&���+��8��-�(���8LQ�t� �s�]�>Am Tr��%� 64>*��5ԍ�l_ �,�+̩�0�/̨ � � 3 & $ yE$!�l��glv�sE�
Requête brute (extrait)
� ��3%�&���+��8��-�(���8LQ�t� �s�]�>Am Tr��%� 64>*��5ԍ�l_ �,�+̩�0�/̨ � � 3 & $ yE$!�l��glv�sE�%���O��U�T�!� \ # + - http/1.1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 241,
"payload_entropy": 5.794404206679687,
"port_category": "registered",
"org": "Google LLC",
"service": "http-alt-8090",
"app_proto": "http-alt-8090",
"asn": 396982,
"country": "JP",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "fc06c824df4a804d476b0e89a599ce8d4ad2c0c4",
"event_fingerprint": "73de1024b23993e40693db328fc9a5b5266e5167",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0768"
],
"classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "http-alt-8090",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "95f8cc672662b106cd1e28d31a7af62c",
"path_pattern_hash": "ced820066cc8b42921bb5be056af57a9",
"ja3": "ae8e71d803bcabe2ffe20e630baf10c0",
"ja4": "923b0b0fdda602d40b490b4d50443649",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "ae8e71d803bcabe2ffe20e630baf10c0",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,51-10-35-43-23-11-45-13-16-5,29-23-24,0",
"tls_ja4_hash": "923b0b0fdda602d40b490b4d50443649",
"tls_ja4": "t13d0110_b777be83f09a_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8090,
"service": "http-alt-8090",
"service_name": "http-alt-8090",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0002\u00123%\ufffd&\ufffd\u0005\ufffd\ufffd+\ufffd\u0016\ufffd8\ufffd\ufffd-\ufffd\u0005(\ufffd\ufffd\ufffd8LQ\ufffdt\ufffd \ufffds\u0010\ufffd\u0013]\u0005\ufffd>Am\u001cT\u0016r\ufffd\ufffd%\ufffd\t64>*\ufffd\ufffd5\u050d\ufffdl_\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 yE$!\ufffdl\ufffd\ufffdglv\ufffdsE\ufffd\u000e",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0002\u00123%\ufffd&\ufffd\u0005\ufffd\ufffd+\ufffd\u0016\ufffd8\ufffd\ufffd-\ufffd\u0005(\ufffd\ufffd\ufffd8LQ\ufffdt\ufffd \ufffds\u0010\ufffd\u0013]\u0005\ufffd>Am\u001cT\u0016r\ufffd\ufffd%\ufffd\t64>*\ufffd\ufffd5\u050d\ufffdl_\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 yE$!\ufffdl\ufffd\ufffdglv\ufffdsE\ufffd\u000e%\ufffd\ufffd\ufffdO\ufffd\ufffdU\ufffdT\ufffd!\u0006\ufffd\t\\\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0017\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0002\u00123%\ufffd&\ufffd\u0005\ufffd\ufffd+\ufffd\u0016\ufffd8\ufffd\ufffd-\ufffd\u0005(\ufffd\ufffd\ufffd8LQ\ufffdt\ufffd \ufffds\u0010\ufffd\u0013]\u0005\ufffd>Am\u001cT\u0016r\ufffd\ufffd%\ufffd\t64>*\ufffd\ufffd5\u050d\ufffdl_\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 yE$!\ufffdl\ufffd\ufffdglv\ufffdsE\ufffd\u000e",
"classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "26664a19378ca237791749367222cf11833caa6c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0002\u00123%\ufffd&\ufffd\u0005\ufffd\ufffd+\ufffd\u0016\ufffd8\ufffd\ufffd-\ufffd\u0005(\ufffd\ufffd\ufffd8LQ\ufffdt\ufffd \ufffds\u0010\ufffd\u0013]\u0005\ufffd>Am\u001cT\u0016r\ufffd\ufffd%\ufffd\t64>*\ufffd\ufffd5\u050d\ufffdl_\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 yE$!\ufffdl\ufffd\ufffdglv\ufffdsE\ufffd\u000e",
"tls_ja3": "ae8e71d803bcabe2ffe20e630baf10c0",
"tls_ja4": "923b0b0fdda602d40b490b4d50443649",
"port": 8090,
"service": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090"
},
"evidence_snippet": "\ufffd\ufffd\ufffd3%\ufffd&\ufffd\ufffd\ufffd+\ufffd\ufffd8\ufffd\ufffd-\ufffd(\ufffd\ufffd\ufffd8LQ\ufffdt\ufffd \ufffds\ufffd]\ufffd>AmTr\ufffd\ufffd%\ufffd\t64>*\ufffd\ufffd5\u050d\ufffdl_\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3&$ yE$!\ufffdl\ufffd\ufffdglv\ufffdsE\ufffd",
"attack_vector": "http-alt-8090 \u00b7 via HTTP ALT 8090:8090 \u00b7 (sonde \/ probe)",
"target_port_label": "8090 \u00b7 HTTP ALT 8090",
"emulator_service": "http-alt-8090",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"pat-0768"
],
"tags_summary_labels_fr": [
"pat-0768"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8090",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0002\u00123%\ufffd&\ufffd\u0005\ufffd\ufffd+\ufffd\u0016\ufffd8\ufffd\ufffd-\ufffd\u0005(\ufffd\ufffd\ufffd8LQ\ufffdt\ufffd \ufffds\u0010\ufffd\u0013]\u0005\ufffd>Am\u001cT\u0016r\ufffd\ufffd%\ufffd\t64>*\ufffd\ufffd5\u050d\ufffdl_\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 yE$!\ufffdl\ufffd\ufffdglv\ufffdsE\ufffd\u000e",
"tls_ja3": "ae8e71d803bcabe2ffe20e630baf10c0",
"tls_ja4": "923b0b0fdda602d40b490b4d50443649",
"port": 8090,
"service": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090"
},
"attack_vector": "http-alt-8090 \u00b7 via HTTP ALT 8090:8090 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd3%\ufffd&\ufffd\ufffd\ufffd+\ufffd\ufffd8\ufffd\ufffd-\ufffd(\ufffd\ufffd\ufffd8LQ\ufffdt\ufffd \ufffds\ufffd]\ufffd>AmTr\ufffd\ufffd%\ufffd\t64>*\ufffd\ufffd5\u050d\ufffdl_\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3&$ yE$!\ufffdl\ufffd\ufffdglv\ufffdsE\ufffd",
"target_port_label": "8090 \u00b7 HTTP ALT 8090",
"emulator_service": "http-alt-8090",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8090",
"service_banner": "honeypot-http-alt-8090",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8090 · (tentative d'exploit) · → /.git/config
|
Élevée
|
Moyen · 59
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8090
Chemin / cible
/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0198
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.git/config
Ligne de requête
GET /.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:8090
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "112b403ea5b0e3a7d0d331ab96d728785c3ab96b",
"http_target_hash": "e2f253eab0d0cf5422d24d22ae2a4954398768df",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 98,
"payload_entropy": 4.977446268951007,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "JP",
"dst_port": 8090,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 7.2,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 59,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "2356a2eb224c7b5cd02df80d2142c4537bebd270",
"event_fingerprint": "6bd56852734aad3b7e4e7a44f47adc53091e84d5",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0198",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0198",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0198"
],
"matched_pattern_names": [
"Probe \/.git\/config"
],
"pattern_ids": [
"pat-0198"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "ec6bcb45c5e4e537130febe59b5dc57a",
"path_pattern_hash": "3ec26e4f0817b37785cd5e68fed88892"
},
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"method": "GET",
"path": "\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/.git\/config HTTP\/1.1",
"request_sample": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"payload_snippet": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"evidence": {
"method": "GET",
"path": "\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/.git\/config HTTP\/1.1",
"request_sample": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"payload_snippet": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fd646c64f25b5ddc5072ea2d720a3255d287e229",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.git\/config",
"request_line": "GET \/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"attack_vector": "config file probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.git\/config",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0198",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0198",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.git\/config",
"request_line": "GET \/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.git\/config",
"evidence_snippet": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8090"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_probe_git",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8090 · (tentative d'exploit) · → /api/.git/config
|
Élevée
|
Moyen · 64
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /api/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
18
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
950600:k8s-api
http_backup_file_scan
Cible HTTP
GET
/api/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8090
Chemin / cible
/api/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /api/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
k8s-api
Payload (extrait)
GET /api/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:8090
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "112b403ea5b0e3a7d0d331ab96d728785c3ab96b",
"http_target_hash": "4d60538c38eae0fe13cbc99a2ea3645cbb337669",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 102,
"payload_entropy": 4.982700195932455,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "JP",
"dst_port": 8090,
"risk_waf": 80,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 7.6,
"risk_breakdown": {
"waf": 80,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 64,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "9105296c9456472d6ec71aa9bcc16052f367eec5",
"event_fingerprint": "f0fa4892129e72d7a418ba3ab4e7e86772b89cff",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 80,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 64,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "a521abb07296197645e401f0392d9153",
"path_pattern_hash": "3ed56f63a5d3aef03e8853abb49b3eea"
},
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"method": "GET",
"path": "\/api\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0",
"950600:k8s-api"
],
"waf_rule_names": [
"nosqli-3",
"leak-0",
"k8s-api"
],
"request_line": "GET \/api\/.git\/config HTTP\/1.1",
"request_sample": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"payload_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"evidence": {
"method": "GET",
"path": "\/api\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0",
"950600:k8s-api"
],
"waf_rule_names": [
"nosqli-3",
"leak-0",
"k8s-api"
],
"request_line": "GET \/api\/.git\/config HTTP\/1.1",
"request_sample": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"payload_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2082f4ca86b9a6c63aeca5eb6646b25f3193450c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/.git\/config",
"request_line": "GET \/api\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"attack_vector": "config file probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.git\/config",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 80,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 64,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/.git\/config",
"request_line": "GET \/api\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.git\/config",
"evidence_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 80 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8090"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"950600:k8s-api",
"http_backup_file_scan",
"http_git_exposure",
"http_probe_api",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8090 · (tentative d'exploit) · → /src/.git/config
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /src/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/src/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8090
Chemin / cible
/src/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /src/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /src/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:8090
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "112b403ea5b0e3a7d0d331ab96d728785c3ab96b",
"http_target_hash": "46e050e820087702ef14a381ebad48881db62e31",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 102,
"payload_entropy": 4.955691494930852,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "JP",
"dst_port": 8090,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.9,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 58,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "5dbb4db16f83c4f26fe398a3d3d5c738b2bf3325",
"event_fingerprint": "4431ed344c9b732866402ca8a6b8c1cc66ff7d37",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "ad2802e69e7fa36f62b66a57f34c33ee",
"path_pattern_hash": "83762003e224a5603ed7ad8ff32c59fc"
},
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"method": "GET",
"path": "\/src\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/src\/.git\/config HTTP\/1.1",
"request_sample": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"payload_snippet": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"evidence": {
"method": "GET",
"path": "\/src\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/src\/.git\/config HTTP\/1.1",
"request_sample": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"payload_snippet": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "810c1f513b913787424edaec5007f9e7f7f58e0b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/.git\/config",
"request_line": "GET \/src\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"attack_vector": "config file probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/.git\/config",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/.git\/config",
"request_line": "GET \/src\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/.git\/config",
"evidence_snippet": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8090"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8090 · (tentative d'exploit) · → /public/.git/config
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /public/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/public/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8090
Chemin / cible
/public/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /public/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /public/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:8090
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "112b403ea5b0e3a7d0d331ab96d728785c3ab96b",
"http_target_hash": "8257582ae447b9a2124e0414764cac0aac8808de",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 105,
"payload_entropy": 5.04308951409711,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "JP",
"dst_port": 8090,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.9,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 58,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "5dbb4db16f83c4f26fe398a3d3d5c738b2bf3325",
"event_fingerprint": "12554590e27f8553403d3bb9dc1bbb3d66541658",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "dae59f0cdba908ae19e546e6e2a27b02",
"path_pattern_hash": "78b85c05b86f9869fecb7907511b414c"
},
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"method": "GET",
"path": "\/public\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/public\/.git\/config HTTP\/1.1",
"request_sample": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"payload_snippet": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"evidence": {
"method": "GET",
"path": "\/public\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/public\/.git\/config HTTP\/1.1",
"request_sample": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"payload_snippet": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "38c6486c29884b84fad560c842451b29b90252dd",
"protocol_details": {
"http_method": "GET",
"http_path": "\/public\/.git\/config",
"request_line": "GET \/public\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"attack_vector": "config file probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/public\/.git\/config",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/public\/.git\/config",
"request_line": "GET \/public\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/public\/.git\/config",
"evidence_snippet": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8090"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8090 · (tentative d'exploit) · → /site/.git/config
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /site/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/site/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8090
Chemin / cible
/site/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /site/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /site/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:8090
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "112b403ea5b0e3a7d0d331ab96d728785c3ab96b",
"http_target_hash": "99d75e39037b11054e155a03133c80282ea1c965",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 103,
"payload_entropy": 4.959687518442357,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "JP",
"dst_port": 8090,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.9,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 58,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "5dbb4db16f83c4f26fe398a3d3d5c738b2bf3325",
"event_fingerprint": "a10c5dcbf6d17b2bd10dcf2852b9b132413295ac",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "ee2739c4405524926f69b732bbaa75e3",
"path_pattern_hash": "6901c63c2daa99b93d9d7c027371b852"
},
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"method": "GET",
"path": "\/site\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/site\/.git\/config HTTP\/1.1",
"request_sample": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"payload_snippet": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"evidence": {
"method": "GET",
"path": "\/site\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/site\/.git\/config HTTP\/1.1",
"request_sample": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"payload_snippet": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "300b9bc805b2883cc623f03d0ed928e69d4c2e8f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/site\/.git\/config",
"request_line": "GET \/site\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"attack_vector": "config file probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/site\/.git\/config",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/site\/.git\/config",
"request_line": "GET \/site\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/site\/.git\/config",
"evidence_snippet": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8090"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8090 · (tentative d'exploit) · → /www/.git/config
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /www/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/www/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8090
Chemin / cible
/www/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /www/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /www/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:8090
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "112b403ea5b0e3a7d0d331ab96d728785c3ab96b",
"http_target_hash": "7b5c6d1b9506a8d5fe958dbcf1ffdcdd61f34f9e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 102,
"payload_entropy": 4.982700195932455,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "JP",
"dst_port": 8090,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.9,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 58,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "5dbb4db16f83c4f26fe398a3d3d5c738b2bf3325",
"event_fingerprint": "20a29758a458070b5c8f4d78b312bee34cb2f5fe",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "cb90e69695f499458b2e79a7f73ea2a4",
"path_pattern_hash": "2067f182832f5bbc5f3205656471af53"
},
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"method": "GET",
"path": "\/www\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/www\/.git\/config HTTP\/1.1",
"request_sample": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"payload_snippet": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"evidence": {
"method": "GET",
"path": "\/www\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/www\/.git\/config HTTP\/1.1",
"request_sample": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"payload_snippet": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5375590fecd697e39d26de18ccd139049a0a3b68",
"protocol_details": {
"http_method": "GET",
"http_path": "\/www\/.git\/config",
"request_line": "GET \/www\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"attack_vector": "config file probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/www\/.git\/config",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/www\/.git\/config",
"request_line": "GET \/www\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/www\/.git\/config",
"evidence_snippet": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8090"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8090 · (tentative d'exploit) · → /backend/.git/config
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /backend/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/backend/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8090
Chemin / cible
/backend/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /backend/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /backend/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:8090
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "112b403ea5b0e3a7d0d331ab96d728785c3ab96b",
"http_target_hash": "2482ac6c987d570b89dfba6cfee3dc3ac194789d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 106,
"payload_entropy": 5.012243663050846,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "JP",
"dst_port": 8090,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.9,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 58,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "5dbb4db16f83c4f26fe398a3d3d5c738b2bf3325",
"event_fingerprint": "c46d4c0fb06707ba25ee9d64b18bb2f7bf70ba4c",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "e4d3d72414ffbffaaac3a79ca125bc5b",
"path_pattern_hash": "2de751ea5a34e7a22b69004dc29faa62"
},
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"method": "GET",
"path": "\/backend\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/backend\/.git\/config HTTP\/1.1",
"request_sample": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"payload_snippet": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"evidence": {
"method": "GET",
"path": "\/backend\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/backend\/.git\/config HTTP\/1.1",
"request_sample": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"payload_snippet": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "124aa0543dd8906bb7284f0f840bef3792a39591",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/.git\/config",
"request_line": "GET \/backend\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"attack_vector": "config file probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/.git\/config",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/.git\/config",
"request_line": "GET \/backend\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/.git\/config",
"evidence_snippet": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8090"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8090 · (tentative d'exploit) · → /html/.git/config
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /html/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/html/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8090
Chemin / cible
/html/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /html/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /html/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:8090
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "112b403ea5b0e3a7d0d331ab96d728785c3ab96b",
"http_target_hash": "ed148acba970ce3061829b4dd97608d1a6997773",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 103,
"payload_entropy": 5.036387853684008,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "JP",
"dst_port": 8090,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.9,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 58,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "5dbb4db16f83c4f26fe398a3d3d5c738b2bf3325",
"event_fingerprint": "effac6e2602e16d44b4126eaddef80d584895207",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "adb8398e24fce726ff351a44f4769f1f",
"path_pattern_hash": "985e825857a4aae20b7bcc62b05870c4"
},
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"method": "GET",
"path": "\/html\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/html\/.git\/config HTTP\/1.1",
"request_sample": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"payload_snippet": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"evidence": {
"method": "GET",
"path": "\/html\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/html\/.git\/config HTTP\/1.1",
"request_sample": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"payload_snippet": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7835582aa3766afaf4b7bf0780da2f77149b875e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/html\/.git\/config",
"request_line": "GET \/html\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"attack_vector": "config file probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/html\/.git\/config",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/html\/.git\/config",
"request_line": "GET \/html\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/html\/.git\/config",
"evidence_snippet": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8090"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8090 · (tentative d'exploit) · → /wordpress/.git/config
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /wordpress/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/wordpress/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8090
Chemin / cible
/wordpress/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /wordpress/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /wordpress/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:8090
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "112b403ea5b0e3a7d0d331ab96d728785c3ab96b",
"http_target_hash": "466d1ef9599315e8ea185d729b1bb7f4ef3f3e3e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 4.973463345904683,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "JP",
"dst_port": 8090,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.9,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 58,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "5dbb4db16f83c4f26fe398a3d3d5c738b2bf3325",
"event_fingerprint": "21878a2431778cbf2bab438bcfb6f6bdf234fdb6",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "826cc3e6180dbcece2d4df9885f417f6",
"path_pattern_hash": "065fde2a84971d9e936ccb4d03006f9c"
},
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"method": "GET",
"path": "\/wordpress\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/wordpress\/.git\/config HTTP\/1.1",
"request_sample": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"payload_snippet": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"evidence": {
"method": "GET",
"path": "\/wordpress\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/wordpress\/.git\/config HTTP\/1.1",
"request_sample": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"payload_snippet": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "94188ac210d477b8de4c2f9a1f99d8abddd8d487",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wordpress\/.git\/config",
"request_line": "GET \/wordpress\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"attack_vector": "config file probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wordpress\/.git\/config",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wordpress\/.git\/config",
"request_line": "GET \/wordpress\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wordpress\/.git\/config",
"evidence_snippet": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8090"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8090 · (tentative d'exploit) · → /var/www/.git/config
|
Élevée
|
Élevé · 69
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /var/www/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950312:lfi-13
950468:nosqli-3
950513:leak-0
http_backup_file_scan
Cible HTTP
GET
/var/www/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8090
Chemin / cible
/var/www/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « lfi-13 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /var/www/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
lfi-13
nosqli-3
leak-0
Payload (extrait)
GET /var/www/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:8090
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "112b403ea5b0e3a7d0d331ab96d728785c3ab96b",
"http_target_hash": "5bc04837a815dc3b9c63afd166a20d43881e48d8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 106,
"payload_entropy": 4.995477800093525,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "JP",
"dst_port": 8090,
"risk_waf": 96,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 7.2,
"risk_breakdown": {
"waf": 96,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "6b8376a57744beb9b47ced4acea351f44afcdca6",
"event_fingerprint": "b47e2473c564fffa79b71d97c198a6bef2637e35",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-13 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 96,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "e6b95daed002053f2802ba16672914b8",
"path_pattern_hash": "3bba9c9f0da0327b3f567a33822f22e3"
},
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"method": "GET",
"path": "\/var\/www\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950312:lfi-13",
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"lfi-13",
"nosqli-3",
"leak-0"
],
"request_line": "GET \/var\/www\/.git\/config HTTP\/1.1",
"request_sample": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"payload_snippet": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"evidence": {
"method": "GET",
"path": "\/var\/www\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950312:lfi-13",
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"lfi-13",
"nosqli-3",
"leak-0"
],
"request_line": "GET \/var\/www\/.git\/config HTTP\/1.1",
"request_sample": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"payload_snippet": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-13 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6eeea5abfe56b81d66b73d7b889bb2d8428b26eb",
"protocol_details": {
"http_method": "GET",
"http_path": "\/var\/www\/.git\/config",
"request_line": "GET \/var\/www\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"attack_vector": "config file probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/var\/www\/.git\/config",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-13 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-13 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 96,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/var\/www\/.git\/config",
"request_line": "GET \/var\/www\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/var\/www\/.git\/config",
"evidence_snippet": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8090"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950312:lfi-13",
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8090 · (tentative d'exploit) · → /app/.git/config
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /app/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/app/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8090
Chemin / cible
/app/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /app/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /app/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:8090
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "112b403ea5b0e3a7d0d331ab96d728785c3ab96b",
"http_target_hash": "c0d576333b61f38bb5785040d2824435407a4c84",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 102,
"payload_entropy": 4.982700195932455,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "JP",
"dst_port": 8090,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.9,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 58,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "5dbb4db16f83c4f26fe398a3d3d5c738b2bf3325",
"event_fingerprint": "99e31846723002f89a016495a3a220ad2a881988",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "928985145ad544d5dec62f19052c6b8b",
"path_pattern_hash": "87d63e686c8d80bd28afc993649c7598"
},
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"method": "GET",
"path": "\/app\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/app\/.git\/config HTTP\/1.1",
"request_sample": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"payload_snippet": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"evidence": {
"method": "GET",
"path": "\/app\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/app\/.git\/config HTTP\/1.1",
"request_sample": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"payload_snippet": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4e641e19de631bf073592c58ecd68b819147b099",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/.git\/config",
"request_line": "GET \/app\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"attack_vector": "config file probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/.git\/config",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/.git\/config",
"request_line": "GET \/app\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/.git\/config",
"evidence_snippet": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8090"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8090 · (tentative d'exploit) · → /htdocs/.git/config
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /htdocs/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/htdocs/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8090
Chemin / cible
/htdocs/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /htdocs/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /htdocs/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:8090
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "112b403ea5b0e3a7d0d331ab96d728785c3ab96b",
"http_target_hash": "91751256d60394a8b0340bb86ad1a8313b8dadfa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 105,
"payload_entropy": 4.980326747756321,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "JP",
"dst_port": 8090,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.9,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 58,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "5dbb4db16f83c4f26fe398a3d3d5c738b2bf3325",
"event_fingerprint": "c9e93a472c3d8d7ebc71695bf78731ad33a48c50",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "d627512e04e54e20ad3a55d9edb36900",
"path_pattern_hash": "9d5b4b02a118c63f9864fb4303c2c2fa"
},
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"method": "GET",
"path": "\/htdocs\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/htdocs\/.git\/config HTTP\/1.1",
"request_sample": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"payload_snippet": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"evidence": {
"method": "GET",
"path": "\/htdocs\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/htdocs\/.git\/config HTTP\/1.1",
"request_sample": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090\r\n\r\n",
"payload_snippet": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b6b1d1cccb51522107f7d7e0c9d48fb917faa46e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/htdocs\/.git\/config",
"request_line": "GET \/htdocs\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"attack_vector": "config file probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/htdocs\/.git\/config",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/htdocs\/.git\/config",
"request_line": "GET \/htdocs\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8090 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/htdocs\/.git\/config",
"evidence_snippet": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8090",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8090"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP ALT 8090
|
http-alt-8090
|
http-alt-8090
http-alt-8090 · via HTTP ALT 8090:8090 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 4be749a0677fa74e
Émulateur
HTTP-ALT-8090
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8090
Chemin / cible
—
Service
HTTP ALT 8090
Payload
� �.�<)�;�+�� -�r�@����L �º��H�0 _�V��('� dj��� �-Ht�hX&��ۡ��� �,�+̩�0�/̨ � � http/1.
Pourquoi cette classification : Type « http-alt-8090 » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0768
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �.�<)�;�+�� -�r�@����L �º��H�0 _�V��('�
dj���
�-Ht�hX&��ۡ��� �,�+̩�0�/̨ � �
http/1.
Requête brute (extrait)
� �.�<)�;�+�� -�r�@����L �º��H�0 _�V��('� dj��� �-Ht�hX&��ۡ��� �,�+̩�0�/̨ � � http/1.1 3 & $ M�@>1E�9e�M�� / ڙ�;`\�v�d�' - # +
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 241,
"payload_entropy": 5.779485778076423,
"port_category": "registered",
"org": "Google LLC",
"service": "http-alt-8090",
"app_proto": "http-alt-8090",
"asn": 396982,
"country": "JP",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "fc06c824df4a804d476b0e89a599ce8d4ad2c0c4",
"event_fingerprint": "73de1024b23993e40693db328fc9a5b5266e5167",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0768"
],
"classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "http-alt-8090",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "JP",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d88f55e2d453f535272a27e017e0fdae",
"path_pattern_hash": "ced820066cc8b42921bb5be056af57a9",
"ja3": "4be749a0677fa74e05faf249d8140c90",
"ja4": "7c4103cafeec38e5e81e98a1bd8f9a32",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "4be749a0677fa74e05faf249d8140c90",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,10-16-51-23-45-35-43-13-11-5,29-23-24,0",
"tls_ja4_hash": "7c4103cafeec38e5e81e98a1bd8f9a32",
"tls_ja4": "t13d0110_c23d26c529d5_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8090,
"service": "http-alt-8090",
"service_name": "http-alt-8090",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003.\ufffd<)\ufffd;\ufffd+\u0014\ufffd\ufffd\u0002\u001f-\ufffdr\ufffd@\ufffd\ufffd\ufffd\ufffdL\u001c\ufffd\u00ba\ufffd\ufffdH\ufffd0 _\ufffdV\ufffd\ufffd('\ufffd\ndj\ufffd\ufffd\ufffd\n\ufffd-\u0003Ht\ufffdhX&\ufffd\ufffd\u06e1\ufffd\ufffd\ufffd\u000b\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003.\ufffd<)\ufffd;\ufffd+\u0014\ufffd\ufffd\u0002\u001f-\ufffdr\ufffd@\ufffd\ufffd\ufffd\ufffdL\u001c\ufffd\u00ba\ufffd\ufffdH\ufffd0 _\ufffdV\ufffd\ufffd('\ufffd\ndj\ufffd\ufffd\ufffd\n\ufffd-\u0003Ht\ufffdhX&\ufffd\ufffd\u06e1\ufffd\ufffd\ufffd\u000b\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u00003\u0000&\u0000$\u0000\u001d\u0000 \u001eM\ufffd@>1E\ufffd9e\u0003\ufffdM\ufffd\ufffd\u0000\/\u000b\u0699\ufffd\u000f;`\\\u0002\ufffdv\ufffdd\ufffd'\u0000\u0017\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000#\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003.\ufffd<)\ufffd;\ufffd+\u0014\ufffd\ufffd\u0002\u001f-\ufffdr\ufffd@\ufffd\ufffd\ufffd\ufffdL\u001c\ufffd\u00ba\ufffd\ufffdH\ufffd0 _\ufffdV\ufffd\ufffd('\ufffd\ndj\ufffd\ufffd\ufffd\n\ufffd-\u0003Ht\ufffdhX&\ufffd\ufffd\u06e1\ufffd\ufffd\ufffd\u000b\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.",
"classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5079301ac55ba271e2ad9de0f6d9f8181c1fa500",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003.\ufffd<)\ufffd;\ufffd+\u0014\ufffd\ufffd\u0002\u001f-\ufffdr\ufffd@\ufffd\ufffd\ufffd\ufffdL\u001c\ufffd\u00ba\ufffd\ufffdH\ufffd0 _\ufffdV\ufffd\ufffd('\ufffd\ndj\ufffd\ufffd\ufffd\n\ufffd-\u0003Ht\ufffdhX&\ufffd\ufffd\u06e1\ufffd\ufffd\ufffd\u000b\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.",
"tls_ja3": "4be749a0677fa74e05faf249d8140c90",
"tls_ja4": "7c4103cafeec38e5e81e98a1bd8f9a32",
"port": 8090,
"service": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090"
},
"evidence_snippet": "\ufffd\ufffd.\ufffd<)\ufffd;\ufffd+\ufffd\ufffd-\ufffdr\ufffd@\ufffd\ufffd\ufffd\ufffdL\ufffd\u00ba\ufffd\ufffdH\ufffd0 _\ufffdV\ufffd\ufffd('\ufffd\ndj\ufffd\ufffd\ufffd\n\ufffd-Ht\ufffdhX&\ufffd\ufffd\u06e1\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\n\thttp\/1.",
"attack_vector": "http-alt-8090 \u00b7 via HTTP ALT 8090:8090 \u00b7 (sonde \/ probe)",
"target_port_label": "8090 \u00b7 HTTP ALT 8090",
"emulator_service": "http-alt-8090",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"pat-0768"
],
"tags_summary_labels_fr": [
"pat-0768"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8090",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003.\ufffd<)\ufffd;\ufffd+\u0014\ufffd\ufffd\u0002\u001f-\ufffdr\ufffd@\ufffd\ufffd\ufffd\ufffdL\u001c\ufffd\u00ba\ufffd\ufffdH\ufffd0 _\ufffdV\ufffd\ufffd('\ufffd\ndj\ufffd\ufffd\ufffd\n\ufffd-\u0003Ht\ufffdhX&\ufffd\ufffd\u06e1\ufffd\ufffd\ufffd\u000b\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.",
"tls_ja3": "4be749a0677fa74e05faf249d8140c90",
"tls_ja4": "7c4103cafeec38e5e81e98a1bd8f9a32",
"port": 8090,
"service": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090"
},
"attack_vector": "http-alt-8090 \u00b7 via HTTP ALT 8090:8090 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd.\ufffd<)\ufffd;\ufffd+\ufffd\ufffd-\ufffdr\ufffd@\ufffd\ufffd\ufffd\ufffdL\ufffd\u00ba\ufffd\ufffdH\ufffd0 _\ufffdV\ufffd\ufffd('\ufffd\ndj\ufffd\ufffd\ufffd\n\ufffd-Ht\ufffdhX&\ufffd\ufffd\u06e1\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\n\thttp\/1.",
"target_port_label": "8090 \u00b7 HTTP ALT 8090",
"emulator_service": "http-alt-8090",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8090",
"service_banner": "honeypot-http-alt-8090",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|