|
|
TCP |
4343 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:4343 · (sonde / probe) · → /favicon.ico
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
Découverte
Accès
Protocole
GET /favicon.ico UA Opera/9.80 (Windows NT 6.1; U; en) Presto/2.8.131 Version/11.11
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
4343
Chemin / cible
/favicon.ico
Pourquoi cette classification : Sonde HTTP (tag rce-0) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance 50 % — Motif catalogue confirmé · 2 tag(s) WAF
Signaux
Requête favicon.ico
Single Port
Chemin bénin connu
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Opera/9.80 (Windows NT 6.1; U; en) Presto/2.8.131 Version/11.11
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:4343
User-Agent: Opera/9.80 (Windows NT 6.1; U; en) Presto/2.8.131 Version/11.11
A
Requête brute (extrait)
GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:4343 User-Agent: Opera/9.80 (Windows NT 6.1; U; en) Presto/2.8.131 Version/11.11 Accept: */* Accept-Encoding: deflate, gzip
Meta JSON brut
{"http_header_count":4,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"d70c14e9bb8bbb41dec773a8052ef8812c76935e","http_host_hash":"23eed0bf3e1b6da723764af5d870a5f428c3b767","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":174,"payload_entropy":5.187065391445084,"port_category":"registered","org":"Alibaba (US) Technology Co., Ltd.","service":"http","app_proto":"http","asn":45102,"country":"SG","dst_port":4343,"risk_waf":60,"risk_classification":42,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.2,"risk_breakdown":{"waf":60,"classification":42,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":42,"tag_count":2,"anomaly_count":0,"campaign_key":"c0fd5019d48de64d7691c81bda6fd113f80407cb","event_fingerprint":"69059f9eeb3d16c99c5f3912bbe7ecd97c5d461f","classification_reason":"Sonde HTTP (tag rce-0) \u00b7 confiance 50%","confidence":0.58,"classification_confidence":0.58,"precision_score":94,"precision_signals":["INT-benign-favicon","INT-single-port","INT-benign-path-cap"],"kb_rule_ids":["INT-benign-favicon","INT-single-port","INT-benign-path-cap"],"confidence_breakdown":{"waf":60,"classification":42,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":42,"correlation_boost":8},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":5…
|
|
|
TCP |
4343 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:4343 · (tentative d'exploit)
|
Élevée
|
Moyen · 44
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
Accès
Exécution
Protocole
GET / UA Opera/9.80 (Windows NT 6.1; U; en) Presto/2.8.131 Version/11.11
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
4343
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
70%
Corrélation +8
Risque capteur
Moyen
· 44
Confiance : Confiance 62 % — 3 tag(s) WAF
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
Accès initial
Exécution
Ligne de requête
GET / HTTP/1.1
User-Agent
Opera/9.80 (Windows NT 6.1; U; en) Presto/2.8.131 Version/11.11
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:4343
User-Agent: Opera/9.80 (Windows NT 6.1; U; en) Presto/2.8.131 Version/11.11
Accept: */*
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:4343 User-Agent: Opera/9.80 (Windows NT 6.1; U; en) Presto/2.8.131 Version/11.11 Accept: */* Accept-Encoding: deflate, gzip Connection: close Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Meta JSON brut
{"http_header_count":6,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"d70c14e9bb8bbb41dec773a8052ef8812c76935e","http_host_hash":"23eed0bf3e1b6da723764af5d870a5f428c3b767","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":248,"payload_entropy":5.382905645516653,"port_category":"registered","org":"Alibaba (US) Technology Co., Ltd.","service":"http","app_proto":"http","asn":45102,"country":"SG","dst_port":4343,"risk_waf":72,"risk_classification":72,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.5,"risk_breakdown":{"waf":72,"classification":72,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":44,"tag_count":3,"anomaly_count":0,"campaign_key":"d57bc6001cc8989d647dda45412d47c8f3146b24","event_fingerprint":"44e022e956246682705d78e8086e4a8bac968e30","classification_reason":"Tentative d'exploit (tag rce-0) \u00b7 confiance 62%","confidence":0.7,"classification_confidence":0.7,"precision_score":73,"precision_signals":["MITRE-T1190"],"kb_rule_ids":["MITRE-T1190"],"confidence_breakdown":{"waf":72,"classification":72,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":44,"correlation_boost":8},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":62,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"SG","asn":4510…
|
|
|
TCP |
6699 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:6699 · (reconnaissance) · → /favicon.ico
|
Élevée
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
MITRE
TA0043
Reconnaissance
Protocole
GET /favicon.ico UA Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Ge…
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950470:nosqli-3
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
6699
Chemin / cible
/favicon.ico
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 50%
Confiance classification
64%
Corrélation +14
Risque capteur
Faible
· 37
Confiance : Confiance 50 % — 1 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Technique MITRE
TA0043
Tactiques MITRE
Reconnaissance
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.95 Safari/537.36
Règles WAF
nosqli-3
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:6699
User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko
Requête brute (extrait)
GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:6699 User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.95 Safari/537.36 Accept: */* Accept-Encoding: deflate, gzip
Meta JSON brut
{"http_header_count":4,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"29c97de30513463c4dccf92df08c6cb19afb147b","http_host_hash":"a50514f1b5e11380d011b79c78179fafd6c3af24","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":212,"payload_entropy":5.385864145140484,"port_category":"registered","org":"Alibaba (US) Technology Co., Ltd.","service":"http","app_proto":"http","asn":45102,"country":"SG","dst_port":6699,"risk_waf":32,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":0.8,"risk_breakdown":{"waf":32,"classification":64,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":37,"tag_count":1,"anomaly_count":0,"campaign_key":"515e0f9856d3e354b27c7d4992807e6c666b1eed","event_fingerprint":"95fb2faf1e770b407bf981af1f768079ee5f66f4","classification_reason":"Tags WAF: nosqli-3 \u00b7 confiance 50%","confidence":0.64,"classification_confidence":0.64,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":32,"classification":64,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":37,"correlation_boost":14},"named_classification_skipped":false,"service_…
|
|
|
TCP |
6699 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:6699 · (reconnaissance)
|
Élevée
|
Moyen · 47
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
MITRE
T1046
Reconnaissance
Protocole
GET / UA Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Ge…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
6699
Chemin / cible
/
Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 47
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
Reconnaissance
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.95 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:6699
User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:6699 User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.95 Safari/537.36 Accept: */* Accept-Encoding: deflate, gzip Connection: close Accept-Language: zh-CN,zh;q=0.9,en;q=0
Meta JSON brut
{"http_header_count":6,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"29c97de30513463c4dccf92df08c6cb19afb147b","http_host_hash":"a50514f1b5e11380d011b79c78179fafd6c3af24","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":286,"payload_entropy":5.508333453728561,"port_category":"registered","org":"Alibaba (US) Technology Co., Ltd.","service":"http","app_proto":"http","asn":45102,"country":"SG","dst_port":6699,"risk_waf":72,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.5,"risk_breakdown":{"waf":72,"classification":64,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":47,"tag_count":3,"anomaly_count":0,"campaign_key":"9ee43e55cb1f1eb0e441c6b6fb04fd4cb53623ff","event_fingerprint":"88cffeaaded8701d1d3dfc653d64e391b01b9a22","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":72,"classification":64,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":47,"correlation_boost":14},"named_classif…
|
|
|
TCP |
6006 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:6006 · (reconnaissance) · → /favicon.ico
|
Élevée
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
MITRE
TA0043
Reconnaissance
Protocole
GET /favicon.ico UA Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Ge…
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950470:nosqli-3
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
6006
Chemin / cible
/favicon.ico
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 50%
Confiance classification
64%
Corrélation +14
Risque capteur
Faible
· 37
Confiance : Confiance 50 % — 1 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Technique MITRE
TA0043
Tactiques MITRE
Reconnaissance
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.95 Safari/537.36
Règles WAF
nosqli-3
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:6006
User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko
Requête brute (extrait)
GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:6006 User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.95 Safari/537.36 Accept: */* Accept-Encoding: deflate, gzip
Meta JSON brut
{"http_header_count":4,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"29c97de30513463c4dccf92df08c6cb19afb147b","http_host_hash":"fe437a0a4a57314a98f9eab6880ad33f9aafcd53","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":212,"payload_entropy":5.370359633452735,"port_category":"registered","org":"Alibaba (US) Technology Co., Ltd.","service":"http","app_proto":"http","asn":45102,"country":"SG","dst_port":6006,"risk_waf":32,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":4,"risk_breakdown":{"waf":32,"classification":64,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":37,"tag_count":1,"anomaly_count":0,"campaign_key":"6d90f055ef3e12db6f7cb2c759cd7c67f173bccb","event_fingerprint":"257dc28ebb22c57e99609c795193a9a2d78b206a","classification_reason":"Tags WAF: nosqli-3 \u00b7 confiance 50%","confidence":0.64,"classification_confidence":0.64,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":32,"classification":64,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":37,"correlation_boost":14},"named_classification_skipped":false,"service_na…
|
|
|
TCP |
6006 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:6006 · (reconnaissance)
|
Élevée
|
Moyen · 50
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
MITRE
T1046
Reconnaissance
Protocole
GET / UA Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Ge…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
6006
Chemin / cible
/
Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
Reconnaissance
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.95 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:6006
User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:6006 User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.95 Safari/537.36 Accept: */* Accept-Encoding: deflate, gzip Connection: close Accept-Language: zh-CN,zh;q=0.9,en;q=0
Meta JSON brut
{"http_header_count":6,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"29c97de30513463c4dccf92df08c6cb19afb147b","http_host_hash":"fe437a0a4a57314a98f9eab6880ad33f9aafcd53","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":286,"payload_entropy":5.496010297113074,"port_category":"registered","org":"Alibaba (US) Technology Co., Ltd.","service":"http","app_proto":"http","asn":45102,"country":"SG","dst_port":6006,"risk_waf":72,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":4.7,"risk_breakdown":{"waf":72,"classification":64,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":50,"tag_count":3,"anomaly_count":0,"campaign_key":"344df34da72f46f3dfdf5068222b76b880a39d04","event_fingerprint":"f21aa374ba1386ea550d49d84cecb942ae38e350","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":72,"classification":64,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":50,"correlation_boost":14},"named_classif…
|
|
|
TCP |
6006 · COAP
|
coap
|
Scan de ports
port scan syn · via COAP:6006 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
MITRE
T1046
Reconnaissance
Protocole
Émulateur
COAP
WAF
—
Recommandation
Surveiller
Tags
coap_get
net_coap_get
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6006
Chemin / cible
—
Service
COAP
Payload
{ 13911391139���{
Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
Reconnaissance
User-Agent
—
Règles WAF
—
Payload (extrait)
{ 13911391139���{
Meta JSON brut
{"bytes_in":22,"payload_entropy":3.192417846776969,"port_category":"registered","org":"Alibaba (US) Technology Co., Ltd.","service":"coap","app_proto":"coap","asn":45102,"country":"SG","dst_port":6006,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.4,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":42,"tag_count":2,"anomaly_count":0,"campaign_key":"dd31424a2807e40e30f5cfdacae6afae85f5f3a7","event_fingerprint":"049dc46bd0a4951f292c57bfdcfbc42d00e1ca25","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"service_name":"coap","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"SG","asn":45102,"org":"Alibaba (US) Technology Co., Ltd.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"9f3c013cfcadcd3e5d5444b6dbd6281a","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"…
|
|
|
TCP |
8070 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8070 · (reconnaissance) · → /favicon.ico
|
Élevée
|
Moyen · 40
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
MITRE
TA0043
Reconnaissance
Protocole
GET /favicon.ico UA Openwave/ UCWEB7.0.2.37/28/999
Émulateur
HTTP
WAF
14
Recommandation
Surveiller
Tags
950318:lfi-14
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8070
Chemin / cible
/favicon.ico
Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 50%
Confiance classification
64%
Corrélation +14
Risque capteur
Moyen
· 40
Confiance : Confiance 50 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Technique MITRE
TA0043
Tactiques MITRE
Reconnaissance
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Openwave/ UCWEB7.0.2.37/28/999
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:8070
User-Agent: Openwave/ UCWEB7.0.2.37/28/999
Accept: */*
Accept-Encoding: defl
Requête brute (extrait)
GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:8070 User-Agent: Openwave/ UCWEB7.0.2.37/28/999 Accept: */* Accept-Encoding: deflate, gzip
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20696d6167652f782d69636f6e0d0a436f6e74656e742d4c656e6774683a2032320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a0000010001001010000001002000680400001600","emulator_response_len":130,"http_header_count":4,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"83604a90c7a23c1d603736fc2f150a136e3f394c","http_host_hash":"2045de7887174d9bf5c5f3b488b17b4b583ca139","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":141,"payload_entropy":5.217219218299485,"port_category":"registered","org":"Alibaba (US) Technology Co., Ltd.","service":"http","app_proto":"http","asn":45102,"country":"SG","dst_port":8070,"risk_waf":64,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":33,"risk_novelty":15,"risk_boost":0,"risk_granularity":2.6,"risk_breakdown":{"waf":64,"classification":64,"behavior":0,"geo":0,"protocol":33,"novelty":15},"risk_score":40,"tag_count":3,"anomaly_count":0,"campaign_key":"72ed562d38599875231cdcd00766d7fdcdd9cd6e","event_fingerprint":"8ef9bb65a3054a439ff7c2f4a73a96fe7c554329","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence":0.64,"classification_confidence":0.64,"precision_score":293,"precision_signals…
|
|
|
TCP |
8070 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8070 · (reconnaissance)
|
Élevée
|
Moyen · 58
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
MITRE
T1046
Reconnaissance
Protocole
GET / UA Openwave/ UCWEB7.0.2.37/28/999
Émulateur
HTTP
WAF
24
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8070
Chemin / cible
/
Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
Reconnaissance
Ligne de requête
GET / HTTP/1.1
User-Agent
Openwave/ UCWEB7.0.2.37/28/999
Règles WAF
lfi-14
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8070
User-Agent: Openwave/ UCWEB7.0.2.37/28/999
Accept: */*
Accept-Encoding: deflate, gzip
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8070 User-Agent: Openwave/ UCWEB7.0.2.37/28/999 Accept: */* Accept-Encoding: deflate, gzip Connection: close Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b","emulator_response_len":82,"http_header_count":6,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"83604a90c7a23c1d603736fc2f150a136e3f394c","http_host_hash":"2045de7887174d9bf5c5f3b488b17b4b583ca139","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":215,"payload_entropy":5.376032250330474,"port_category":"registered","org":"Alibaba (US) Technology Co., Ltd.","service":"http","app_proto":"http","asn":45102,"country":"SG","dst_port":8070,"risk_waf":100,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":33,"risk_novelty":25,"risk_boost":0,"risk_granularity":3.4,"risk_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":0,"protocol":33,"novelty":25},"risk_score":58,"tag_count":5,"anomaly_count":0,"campaign_key":"4556d2ba1ca451184df17ee547c19265ce5a66e5","event_fingerprint":"0be48d4ef1ced53c1f894fc25ed975217b83ed5c","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_id…
|
|
|
TCP |
11434 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:11434 · (reconnaissance) · → /favicon.ico
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
MITRE
TA0043
Reconnaissance
Protocole
GET /favicon.ico UA Mozilla/5.0 (Windows NT 6.1; WOW64; rv:53.0) Gecko/20100101 Fir…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
11434
Chemin / cible
/favicon.ico
Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 50%
Confiance classification
64%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance 50 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Technique MITRE
TA0043
Tactiques MITRE
Reconnaissance
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:11434
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:53.0) Gecko/20100101 Firef
Requête brute (extrait)
GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:11434 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Accept: */* Accept-Encoding: deflate, gzip
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20696d6167652f782d69636f6e0d0a436f6e74656e742d4c656e6774683a2032320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a0000010001001010000001002000680400001600","emulator_response_len":130,"http_header_count":4,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"764a3184397ae8bef434261d128814c5105a8bd7","http_host_hash":"0edcf6ab7022a3c1a90b1ad0670bd95a56782eca","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":184,"payload_entropy":5.277308780118646,"port_category":"registered","org":"Alibaba (US) Technology Co., Ltd.","service":"http","app_proto":"http","asn":45102,"country":"SG","dst_port":11434,"risk_waf":60,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":33,"risk_novelty":15,"risk_boost":0,"risk_granularity":5.2,"risk_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":33,"novelty":15},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"e8d123002fdb67980f0eb0d842df61d87fdf1d1b","event_fingerprint":"83029c996643706d78dc08bb6bbf7eef36f20efa","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence":0.64,"classification_confidence":0.64,"precision_score":231,"precision_signals…
|
|
|
TCP |
11434 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:11434 · (reconnaissance)
|
Élevée
|
Moyen · 51
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
MITRE
T1046
Reconnaissance
Protocole
GET / UA Mozilla/5.0 (Windows NT 6.1; WOW64; rv:53.0) Gecko/20100101 Fir…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
11434
Chemin / cible
/
Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 51
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
Reconnaissance
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:11434
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0
Ac
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:11434 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Accept: */* Accept-Encoding: deflate, gzip Connection: close Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b","emulator_response_len":82,"http_header_count":6,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"764a3184397ae8bef434261d128814c5105a8bd7","http_host_hash":"0edcf6ab7022a3c1a90b1ad0670bd95a56782eca","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":258,"payload_entropy":5.473867214128563,"port_category":"registered","org":"Alibaba (US) Technology Co., Ltd.","service":"http","app_proto":"http","asn":45102,"country":"SG","dst_port":11434,"risk_waf":72,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":33,"risk_novelty":15,"risk_boost":0,"risk_granularity":5.6,"risk_breakdown":{"waf":72,"classification":64,"behavior":0,"geo":0,"protocol":33,"novelty":15},"risk_score":51,"tag_count":4,"anomaly_count":0,"campaign_key":"1ceb5927b6382f021e8b1570f8f5a4d2bc956d6d","event_fingerprint":"a3553765b40ae8c1aad4a494700a0a9576b68290","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":231,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGM…
|
|
|
TCP |
11434 · OLLAMA
|
ollama
|
Scan de ports
port scan syn · via OLLAMA:11434 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
MITRE
T1046
Reconnaissance
Protocole
Émulateur
OLLAMA
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
11434
Chemin / cible
—
Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
Reconnaissance
User-Agent
—
Règles WAF
—
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b","emulator_response_len":82,"port_inferred_service":true,"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"Alibaba (US) Technology Co., Ltd.","service":"ollama","app_proto":"ollama","asn":45102,"country":"SG","dst_port":11434,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":22,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.2,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":22,"novelty":0},"risk_score":42,"tag_count":0,"anomaly_count":0,"campaign_key":"56ce308fbc546a6c4823036bb462dd39e8ce68df","event_fingerprint":"e5de7378bdf0b23e311530c009ea1c8bba9f0677","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":231,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":22,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"service_name":"ollama","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"SG",…
|
|
|
TCP |
1234 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:1234 · (reconnaissance) · → /favicon.ico
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0043
Reconnaissance
Protocole
GET /favicon.ico UA Openwave/ UCWEB7.0.2.37/28/999
Émulateur
HTTP
WAF
14
Recommandation
Surveiller
Tags
950318:lfi-14
950470:nosqli-3
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
1234
Chemin / cible
/favicon.ico
Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance 50 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Technique MITRE
TA0043
Tactiques MITRE
Reconnaissance
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Openwave/ UCWEB7.0.2.37/28/999
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:1234
User-Agent: Openwave/ UCWEB7.0.2.37/28/999
Accept: */*
Accept-Encoding: defl
Requête brute (extrait)
GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:1234 User-Agent: Openwave/ UCWEB7.0.2.37/28/999 Accept: */* Accept-Encoding: deflate, gzip
Meta JSON brut
{"http_header_count":4,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"83604a90c7a23c1d603736fc2f150a136e3f394c","http_host_hash":"48a097f7ea72f8e15cb756cda66be0f90c57cdc7","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":141,"payload_entropy":5.225341537645065,"port_category":"registered","org":"Alibaba (US) Technology Co., Ltd.","service":"http","app_proto":"http","asn":45102,"country":"SG","dst_port":1234,"risk_waf":64,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":4.7,"risk_breakdown":{"waf":64,"classification":64,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":42,"tag_count":2,"anomaly_count":0,"campaign_key":"41a4292edcf42b1558babb12fca82faae50edbd9","event_fingerprint":"6ab7a5234967c6b9fb58168c1d8792392694845e","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence":0.58,"classification_confidence":0.58,"precision_score":231,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":64,"classification":64,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":42,"correlation_boost":8},"named_classification_skipped":false,"service_name…
|
|
|
TCP |
1234 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:1234 · (reconnaissance)
|
Élevée
|
Moyen · 60
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1046
Reconnaissance
Protocole
GET / UA Openwave/ UCWEB7.0.2.37/28/999
Émulateur
HTTP
WAF
24
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
1234
Chemin / cible
/
Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 60
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
Reconnaissance
Ligne de requête
GET / HTTP/1.1
User-Agent
Openwave/ UCWEB7.0.2.37/28/999
Règles WAF
lfi-14
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:1234
User-Agent: Openwave/ UCWEB7.0.2.37/28/999
Accept: */*
Accept-Encoding: deflate, gzip
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:1234 User-Agent: Openwave/ UCWEB7.0.2.37/28/999 Accept: */* Accept-Encoding: deflate, gzip Connection: close Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Meta JSON brut
{"http_header_count":6,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"83604a90c7a23c1d603736fc2f150a136e3f394c","http_host_hash":"48a097f7ea72f8e15cb756cda66be0f90c57cdc7","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":215,"payload_entropy":5.398732643452504,"port_category":"registered","org":"Alibaba (US) Technology Co., Ltd.","service":"http","app_proto":"http","asn":45102,"country":"SG","dst_port":1234,"risk_waf":100,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":5.4,"risk_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":60,"tag_count":4,"anomaly_count":0,"campaign_key":"a80f557185e3d5e2349302616cfd8fcc29971519","event_fingerprint":"587eaa52853a6a56ba34f94d8ded3a6ba1db6169","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":231,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":60,"correlation_boost":8},"named_classification_skipped":false,"service_name":"…
|
|
|
TCP |
1234
|
—
|
Scan de ports
port scan syn · port 1234 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1046
Reconnaissance
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1234
Chemin / cible
—
Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
Reconnaissance
User-Agent
—
Règles WAF
—
Meta JSON brut
{"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"Alibaba (US) Technology Co., Ltd.","service":null,"app_proto":null,"asn":45102,"country":"SG","dst_port":1234,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":4,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":42,"tag_count":0,"anomaly_count":0,"campaign_key":"7c03ca3fe4e1aad5f5a70063226693b28a79b092","event_fingerprint":"e8359bd907303cce482ff88375a40841e086edcf","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":231,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":42,"correlation_boost":8},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"SG","asn":45102,"org":"Alibaba (US) Technology Co., Ltd.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":1234,"risk_score":42},"attack_stage":"recon","mitre_tactics":["TA0043"],"mitre_techniques":["T1046"],"mitre":"…
|
|
|
TCP |
8010 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:8010 · (tentative d'exploit) · → /favicon.ico
|
Élevée
|
Moyen · 41
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
Accès
Exécution
Protocole
GET /favicon.ico UA Mozilla/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8010
Chemin / cible
/favicon.ico
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 89%
Confiance classification
89%
Risque capteur
Moyen
· 41
Confiance : Confiance 89 % — Score WAF 60 · 2 tag(s) WAF
Protocole émulé
1
Technique MITRE
TA0001
Tactiques MITRE
Accès initial
Exécution
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.122 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:8010
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit/537.36 (KHTM
Requête brute (extrait)
GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:8010 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.122 Safari/537.36 Accept: */* Accept-Encoding: deflate, gzip
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20696d6167652f782d69636f6e0d0a436f6e74656e742d4c656e6774683a2032320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a0000010001001010000001002000680400001600","emulator_response_len":130,"http_header_count":4,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"f4703695a65b239c40e3120c3c1031df6f7d4b3f","http_host_hash":"90199038884baa59455d3404a4ba05d942a7b0fe","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":226,"payload_entropy":5.44776888237378,"port_category":"registered","org":"Alibaba (US) Technology Co., Ltd.","service":"http","app_proto":"http","asn":45102,"country":"SG","dst_port":8010,"risk_waf":60,"risk_classification":72,"risk_behavior":0,"risk_geo":0,"risk_protocol":33,"risk_novelty":15,"risk_boost":0,"risk_granularity":3,"risk_breakdown":{"waf":60,"classification":72,"behavior":0,"geo":0,"protocol":33,"novelty":15},"risk_score":41,"tag_count":3,"anomaly_count":0,"campaign_key":"e1b45cdf430d0b5c82bfa1a770ce049c2083e55c","event_fingerprint":"767b6a6d8803df190978e9c73d41909d876590fb","city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"SG","asn":45102,"org":"Alibaba (US) Technology Co., Ltd.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"http_ua_ha…
|
|
|
TCP |
2052 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:2052 · (tentative d'exploit) · → /favicon.ico
|
Élevée
|
Moyen · 41
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
Accès
Exécution
Protocole
GET /favicon.ico UA Mozilla/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2052
Chemin / cible
/favicon.ico
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 86%
Confiance classification
86%
Risque capteur
Moyen
· 41
Confiance : Confiance 86 % — Score WAF 60 · 2 tag(s) WAF
Technique MITRE
TA0001
Tactiques MITRE
Accès initial
Exécution
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.122 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:2052
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit/537.36 (KHTM
Requête brute (extrait)
GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:2052 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.122 Safari/537.36 Accept: */* Accept-Encoding: deflate, gzip
Meta JSON brut
{"http_header_count":4,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"f4703695a65b239c40e3120c3c1031df6f7d4b3f","http_host_hash":"f8fb32d983535100604d938a06b189aaee2da45a","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":226,"payload_entropy":5.446814265686953,"port_category":"registered","org":"Alibaba (US) Technology Co., Ltd.","service":"http","app_proto":"http","asn":45102,"country":"SG","dst_port":2052,"risk_waf":60,"risk_classification":72,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.7,"risk_breakdown":{"waf":60,"classification":72,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":41,"tag_count":2,"anomaly_count":0,"campaign_key":"a3ae43f00a865cb4e814bcd865bae9cfedbaaba0","event_fingerprint":"a4fea16d7cfd8c6be4524ce64d4367c2392708e3","city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"SG","asn":45102,"org":"Alibaba (US) Technology Co., Ltd.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"http_ua_hash":"097e9503088c7538575a5a77add13f6c","payload_hash":"439b5744e8d2e51efd151eeabef571b9","path_pattern_hash":"b18036488649e7cc8a55b0a02c8b737a"},"service_name":"http","target_context":{"dst_port":2052,"service":"http","service_name":"http","risk_score":41},"payload_preview":"GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2052\…
|
|
|
TCP |
8010 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:8010 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
Accès
Exécution
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8010
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 46
Confiance : Confiance 62 % — 3 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
Accès initial
Exécution
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.122 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8010
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit/537.36 (KHTML, like Gec
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8010 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.122 Safari/537.36 Accept: */* Accept-Encoding: deflate, gzip Connection: close Accept-Language: zh-CN,z
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b","emulator_response_len":82,"http_header_count":6,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"f4703695a65b239c40e3120c3c1031df6f7d4b3f","http_host_hash":"90199038884baa59455d3404a4ba05d942a7b0fe","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":300,"payload_entropy":5.551526432334555,"port_category":"registered","org":"Alibaba (US) Technology Co., Ltd.","service":"http","app_proto":"http","asn":45102,"country":"SG","dst_port":8010,"risk_waf":72,"risk_classification":72,"risk_behavior":0,"risk_geo":0,"risk_protocol":33,"risk_novelty":15,"risk_boost":0,"risk_granularity":3.3,"risk_breakdown":{"waf":72,"classification":72,"behavior":0,"geo":0,"protocol":33,"novelty":15},"risk_score":46,"tag_count":4,"anomaly_count":0,"campaign_key":"90946aaa18a71dbdb041e6f5de99cd262d4d0f2d","event_fingerprint":"9355c37cfd1654ec493b724c9c7954bfdb6efe18","classification_reason":"Tentative d'exploit (tag rce-0) \u00b7 confiance 62%","confidence":0.62,"classification_confidence":0.62,"precision_score":73,"precision_signals":["MITRE-T1190"],"kb_rule_ids":["MITRE-T1190"],"confidence_breakdown":{"waf":72,"classification":72,"behavior":0,"geo":0…
|
|
|
TCP |
2052 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:2052 · (tentative d'exploit)
|
Élevée
|
Moyen · 44
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
Accès
Exécution
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2052
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 44
Confiance : Confiance 62 % — 3 tag(s) WAF
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
Accès initial
Exécution
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.122 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:2052
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit/537.36 (KHTML, like Gec
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:2052 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.122 Safari/537.36 Accept: */* Accept-Encoding: deflate, gzip Connection: close Accept-Language: zh-CN,z
Meta JSON brut
{"http_header_count":6,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"f4703695a65b239c40e3120c3c1031df6f7d4b3f","http_host_hash":"f8fb32d983535100604d938a06b189aaee2da45a","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":300,"payload_entropy":5.555381201631178,"port_category":"registered","org":"Alibaba (US) Technology Co., Ltd.","service":"http","app_proto":"http","asn":45102,"country":"SG","dst_port":2052,"risk_waf":72,"risk_classification":72,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":2,"risk_breakdown":{"waf":72,"classification":72,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":44,"tag_count":3,"anomaly_count":0,"campaign_key":"8a8bf95207302eea289be52da1d8d89ba0ebe440","event_fingerprint":"eedb8ee51364d3ac18996377194e7fe9bfbf1186","classification_reason":"Tentative d'exploit (tag rce-0) \u00b7 confiance 62%","confidence":0.62,"classification_confidence":0.62,"precision_score":73,"precision_signals":["MITRE-T1190"],"kb_rule_ids":["MITRE-T1190"],"confidence_breakdown":{"waf":72,"classification":72,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":44},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":62,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"SG","asn":45102,"org":"Alibaba (US) T…
|