Renseignement sur les menaces

Pays-Bas

45.82.56.216

FAI ClearStack B.V. Première vue 11/07/2026 13:26 UTC Dernière vue 14/07/2026 13:44 UTC Risque Critique

Période analysée : 2026-06-20 → 2026-07-20

Activité suspecte · risque 35/100

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

100

Critique · Risque max (7j) Critique

Synthèse exécutive

Profil de menace

Score de risque 100/100 Critique

Première observation 11/07/2026 13:26 UTC

Dernière observation 14/07/2026 13:44 UTC

Événements (période) 22

MITRE ATT&CK principal TA0007 11 occurrences

Activité suspecte · risque 35/100

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « neo4j_probe » (signaux protocolaires) · confiance 50%

Confiance 50 % — Score WAF 8

Comparaison ASN / FAI

ASN 199792 · 45.82.56.0/24 · RIPENCC — 4 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 22 événements sur la période pour cette IP.

45.82.56.217 clickhouse probe 19/07/2026 10:37 UTC
45.82.56.245 Sonde port 19/07/2026 04:49 UTC
45.82.56.246 socks5 probe 19/07/2026 01:14 UTC
45.82.56.218 Traversal LFI 18/07/2026 13:48 UTC

Événements (filtres)

Première observation

11/07/2026 13:26 UTC

Dernière observation

14/07/2026 13:44 UTC

Dernière activité (filtres)

14/07/2026 13:44 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 12 CONSUL TCP 4 COUCHDB TCP 2 NEO4J HTTP TCP 2 WEBLOGIC TCP 1 DOCKER TCP 1

HTTP

CONSUL

COUCHDB

NEO4J HTTP

WEBLOGIC

DOCKER

Géolocalisation

Origine réseau déclarée

Pays-Bas unknown unknown

FAI / réseau

Opérateur et dernière activité ban

ClearStack B.V. 0 Port 7474 http_smuggling_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Sonde / probe

Chaîne d'attaque

Découverte

Vecteur d'attaque

neo4j probe · via NEO4J HTTP:7474 · (sonde / probe)

Détails protocole

Aperçu payload

��>n(ˋz9�˾$G��՗~��qU�I�<�l� қu��a�.�k��f@�"*��->�ۃ�"�,�0�+�/̨̩�$�(�#�'��kgf�

Port / service

7474 · NEO4J HTTP

Service émulé

NEO4J-HTTP

Raison confiance

Confiance 50 % — Motif catalogue confirmé

Technique MITRE

TA0007

Persona capteur

mail.sensor-1.internal

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

pat-0771

Confiance

50% Confiance modérée — signal unique

Famille de menace

scanner

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

22 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

22 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
14/07/2026 13:44:16 UTC	TCP	7474 · NEO4J HTTP	neo4j-http	Sonde HTTP smuggling http smuggling probe · via NEO4J HTTP:7474 · (tentative d'exploit)	Élevée	Moyen · 52
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur NEO4J-HTTP WAF — Recommandation Investiguer Tags neo4j_http_emulated neo4j_http_payload net_neo4j_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7474 Chemin / cible — Service NEO4J HTTP Payload POST /db/neo4j/tx/commit HTTP/1.1 Accept-Encoding: identity Content-Length: 43 Host: 62.3.50.33:7474 User-Agent: Python-urll Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 52 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL User-Agent — Règles WAF — Payload (extrait) POST /db/neo4j/tx/commit HTTP/1.1 Accept-Encoding: identity Content-Length: 43 Host: 62.3.50.33:7474 User-Agent: Python-urll Requête brute (extrait) POST /db/neo4j/tx/commit HTTP/1.1 Accept-Encoding: identity Content-Length: 43 Host: 62.3.50.33:7474 User-Agent: Python-urllib/3.11 Content-Type: application/json Accept: application/json Connection: close {"statements": [{"statement": "RETURN 1" Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206e656f346a5f6874747020726561647920706f72743d373437340d0a", "emulator_response_len": 41, "bytes_in": 259, "payload_entropy": 5.139848486520825, "port_category": "registered", "org": "ClearStack B.V.", "service": "neo4j-http", "app_proto": "neo4j-http", "asn": 199792, "country": "NL", "dst_port": 7474, "risk_waf": 8, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.5, "risk_breakdown": { "waf": 8, "classification": 85, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 52, "tag_count": 3, "anomaly_count": 0, "campaign_key": "90c43edb9107ade88416dfdee6adc0766b86ce06", "event_fingerprint": "ffdd3fa787ef458447ff0cfdafc3f198ff9634ff", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 8, "classification": 85, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 52 }, "named_classification_skipped": false, "service_name": "neo4j-http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 199792, "org": "ClearStack B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2a487f4ebb021ab40a7cd7d442bafe14", "path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a" }, "target_context": { "dst_port": 7474, "service": "neo4j-http", "service_name": "neo4j-http", "risk_score": 52 }, "payload_preview": "POST \/db\/neo4j\/tx\/commit HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 43\r\nHost: 62.3.50.33:7474\r\nUser-Agent: Python-urll", "request_sample": "POST \/db\/neo4j\/tx\/commit HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 43\r\nHost: 62.3.50.33:7474\r\nUser-Agent: Python-urllib\/3.11\r\nContent-Type: application\/json\r\nAccept: application\/json\r\nConnection: close\r\n\r\n{\"statements\": [{\"statement\": \"RETURN 1\"", "payload_snippet": "POST \/db\/neo4j\/tx\/commit HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 43\r\nHost: 62.3.50.33:7474\r\nUser-Agent: Python-urll", "evidence": { "request_sample": "POST \/db\/neo4j\/tx\/commit HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 43\r\nHost: 62.3.50.33:7474\r\nUser-Agent: Python-urllib\/3.11\r\nContent-Type: application\/json\r\nAccept: application\/json\r\nConnection: close\r\n\r\n{\"statements\": [{\"statement\": \"RETURN 1\"", "payload_snippet": "POST \/db\/neo4j\/tx\/commit HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 43\r\nHost: 62.3.50.33:7474\r\nUser-Agent: Python-urll", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b66a1d1d0b51b849c75f6d2a3fca2c0f5664682f", "protocol_details": { "payload_preview": "POST \/db\/neo4j\/tx\/commit HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 43\r\nHost: 62.3.50.33:7474\r\nUser-Agent: Python-urll", "port": 7474, "service": "neo4j-http", "service_label_fr": "NEO4J HTTP" }, "evidence_snippet": "POST \/db\/neo4j\/tx\/commit HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 43\r\nHost: 62.3.50.33:7474\r\nUser-Agent: Python-urll", "attack_vector": "http smuggling probe \u00b7 via NEO4J HTTP:7474 \u00b7 (tentative d'exploit)", "target_port_label": "7474 \u00b7 NEO4J HTTP", "emulator_service": "neo4j-http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via NEO4J HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 85, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 52 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 52, "risk_label": "Moyen", "service_name": "neo4j-http", "service_label_fr": "NEO4J HTTP", "dst_port": 7474, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-neo4j-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "POST \/db\/neo4j\/tx\/commit HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 43\r\nHost: 62.3.50.33:7474\r\nUser-Agent: Python-urll", "port": 7474, "service": "neo4j-http", "service_label_fr": "NEO4J HTTP" }, "attack_vector": "http smuggling probe \u00b7 via NEO4J HTTP:7474 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/db\/neo4j\/tx\/commit HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 43\r\nHost: 62.3.50.33:7474\r\nUser-Agent: Python-urll", "target_port_label": "7474 \u00b7 NEO4J HTTP", "emulator_service": "neo4j-http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "neo4j_http", "service_banner": "honeypot-neo4j-http", "service_os": "linux", "dst_port": "7474" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "neo4j_http_emulated", "neo4j_http_payload", "net_neo4j_probe" ] }
14/07/2026 13:44:16 UTC	TCP	7474 · NEO4J HTTP	neo4j-http	neo4j probe neo4j probe · via NEO4J HTTP:7474 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur NEO4J-HTTP WAF — Recommandation Surveiller Tags neo4j_http_emulated neo4j_http_payload net_neo4j_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7474 Chemin / cible — Service NEO4J HTTP Payload ��>n(ˋz9�˾$G��՗~��qU�I�<�l� қu��a�.�k��f@�"��->�ۃ�"�,�0�+�/̨̩�$�(�#�'��kgf� Pourquoi cette classification :* Type « neo4j_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��>n(ˋz9�˾$G��՗~��qU�I�<�l� қu��a�.�k��f@�"��->�ۃ�"�,�0�+�/̨̩�$�(�#�'��kgf� Requête brute (extrait) ��>n(ˋz9�˾$G��՗~��qU�I�<�l� қu��a�.�k��f@�"��->�ۃ�"�,�0�+�/̨̩�$�(�#�'��kgf� �# 64 +-3��(�7�h KJQb Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206e656f346a5f6874747020726561647920706f72743d373437340d0a", "emulator_response_len": 41, "bytes_in": 1498, "payload_entropy": 7.7496883251285, "port_category": "registered", "org": "ClearStack B.V.", "service": "neo4j-http", "app_proto": "neo4j-http", "asn": 199792, "country": "NL", "dst_port": 7474, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.9, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 35, "tag_count": 4, "anomaly_count": 0, "campaign_key": "974b8feb12e5244aad66dfdc819b5215a84d9b75", "event_fingerprint": "ffdd3fa787ef458447ff0cfdafc3f198ff9634ff", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab neo4j_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35 }, "service_name": "neo4j-http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 199792, "org": "ClearStack B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b43f2ad3f24f19f13e50146dbb4adc46", "path_pattern_hash": "f73c9a0e87cbb3a4f1935c8231eef1b9" }, "target_context": { "dst_port": 7474, "service": "neo4j-http", "service_name": "neo4j-http", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003>n(\u02cbz\u00199\ufffd\u02fe$G\ufffd\ufffd\ufffd\u0557~\ufffd\ufffdqU\u001a\ufffdI\ufffd<\ufffdl\ufffd \u049bu\ufffd\ufffd\ufffd\ufffda\ufffd.\ufffdk\ufffd\ufffdf@\ufffd\u0003\"\u0000\ufffd\ufffd\ufffd->\u0002\ufffd\u06c3\u001a\ufffd\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005f\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0004\u0003\u0000\u0001", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003>n(\u02cbz\u00199\ufffd\u02fe$G\ufffd\ufffd\ufffd\u0557~\ufffd\ufffdqU\u001a\ufffdI\ufffd<\ufffdl\ufffd \u049bu\ufffd\ufffd\ufffd\ufffda\ufffd.\ufffdk\ufffd\ufffdf@\ufffd\u0003\"\u0000\ufffd\ufffd\ufffd->\u0002\ufffd\u06c3\u001a\ufffd\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005f\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0001\u0000\u0001\u0001\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u00006\u00004\t\u0005\t\u0006\t\u0004\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\u001a\b\u001b\b\u001c\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd(\ufffd7\ufffdh\fKJQb", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003>n(\u02cbz\u00199\ufffd\u02fe$G\ufffd\ufffd\ufffd\u0557~\ufffd\ufffdqU\u001a\ufffdI\ufffd<\ufffdl\ufffd \u049bu\ufffd\ufffd\ufffd\ufffda\ufffd.\ufffdk\ufffd\ufffdf@\ufffd\u0003\"\u0000\ufffd\ufffd\ufffd->\u0002\ufffd\u06c3\u001a\ufffd\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005f\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0004\u0003\u0000\u0001", "classification_reason": "Type \u00ab neo4j_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e8097ced5bb935ca902e2c31f04f031faebf246a", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003>n(\u02cbz\u00199\ufffd\u02fe$G\ufffd\ufffd\ufffd\u0557~\ufffd\ufffdqU\u001a\ufffdI\ufffd<\ufffdl\ufffd \u049bu\ufffd\ufffd\ufffd\ufffda\ufffd.\ufffdk\ufffd\ufffdf@\ufffd\u0003\"\u0000\ufffd\ufffd\ufffd->\u0002\ufffd\u06c3\u001a\ufffd\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005f\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0004\u0003\u0000\u0001", "port": 7474, "service": "neo4j-http", "service_label_fr": "NEO4J HTTP" }, "evidence_snippet": "\ufffd\ufffd>n(\u02cbz9\ufffd\u02fe$G\ufffd\ufffd\ufffd\u0557~\ufffd\ufffdqU\ufffdI\ufffd<\ufffdl\ufffd \u049bu\ufffd\ufffd\ufffd\ufffda\ufffd.\ufffdk\ufffd\ufffdf@\ufffd\"\ufffd\ufffd\ufffd->\ufffd\u06c3\ufffd\"\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkgf\ufffd", "attack_vector": "neo4j probe \u00b7 via NEO4J HTTP:7474 \u00b7 (sonde \/ probe)", "target_port_label": "7474 \u00b7 NEO4J HTTP", "emulator_service": "neo4j-http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab neo4j_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab neo4j_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "neo4j-http", "service_label_fr": "NEO4J HTTP", "dst_port": 7474, "protocol_emulated": true, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-neo4j-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003>n(\u02cbz\u00199\ufffd\u02fe$G\ufffd\ufffd\ufffd\u0557~\ufffd\ufffdqU\u001a\ufffdI\ufffd<\ufffdl\ufffd \u049bu\ufffd\ufffd\ufffd\ufffda\ufffd.\ufffdk\ufffd\ufffdf@\ufffd\u0003\"\u0000\ufffd\ufffd\ufffd->\u0002\ufffd\u06c3\u001a\ufffd\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005f\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0004\u0003\u0000\u0001", "port": 7474, "service": "neo4j-http", "service_label_fr": "NEO4J HTTP" }, "attack_vector": "neo4j probe \u00b7 via NEO4J HTTP:7474 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd>n(\u02cbz9\ufffd\u02fe$G\ufffd\ufffd\ufffd\u0557~\ufffd\ufffdqU\ufffdI\ufffd<\ufffdl\ufffd \u049bu\ufffd\ufffd\ufffd\ufffda\ufffd.\ufffdk\ufffd\ufffdf@\ufffd\"*\ufffd\ufffd\ufffd->\ufffd\u06c3\ufffd\"\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkgf\ufffd", "target_port_label": "7474 \u00b7 NEO4J HTTP", "emulator_service": "neo4j-http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "neo4j_http", "service_banner": "honeypot-neo4j-http", "service_os": "linux", "dst_port": "7474" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "neo4j_http_emulated", "neo4j_http_payload", "net_neo4j_probe", "tls_clienthello" ] }
14/07/2026 07:01:00 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 30
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /v1/status/leader HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33:8500 User-Agent: Mozilla/5.0 Connection: close Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 30 Confiance : Confiance 0 % — 6 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /v1/status/leader HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33:8500 User-Agent: Mozilla/5.0 Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 128, "payload_entropy": 5.000955059911622, "port_category": "registered", "org": "ClearStack B.V.", "service": "consul", "app_proto": "consul", "asn": 199792, "country": "NL", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 30, "tag_count": 6, "anomaly_count": 0, "campaign_key": "af9594ea6f43e1773816eda1794f59876845647a", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 30 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 199792, "org": "ClearStack B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7bebddfc37019218d65dc916538817a9", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 30 }, "payload_preview": "GET \/v1\/status\/leader HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close\r\n\r\n", "request_sample": "GET \/v1\/status\/leader HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/v1\/status\/leader HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close", "evidence": { "request_sample": "GET \/v1\/status\/leader HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/v1\/status\/leader HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0691319c65481e35322b70a0e94735f38d585018", "protocol_details": { "payload_preview": "GET \/v1\/status\/leader HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/v1\/status\/leader HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 30\/100", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 30 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 30, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/v1\/status\/leader HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/v1\/status\/leader HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "mozi_pattern", "net_consul_probe" ] }
14/07/2026 07:01:00 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 30
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /v1/kv/?recurse=true HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33:8500 User-Agent: Mozilla/5.0 Connection: close Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 30 Confiance : Confiance 0 % — 6 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /v1/kv/?recurse=true HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33:8500 User-Agent: Mozilla/5.0 Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 131, "payload_entropy": 5.082322479766562, "port_category": "registered", "org": "ClearStack B.V.", "service": "consul", "app_proto": "consul", "asn": 199792, "country": "NL", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 30, "tag_count": 6, "anomaly_count": 0, "campaign_key": "af9594ea6f43e1773816eda1794f59876845647a", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 30 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 199792, "org": "ClearStack B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0e88614b17ab09b2abcf3e996c02dfd0", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 30 }, "payload_preview": "GET \/v1\/kv\/?recurse=true HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close\r", "request_sample": "GET \/v1\/kv\/?recurse=true HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/v1\/kv\/?recurse=true HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close", "evidence": { "request_sample": "GET \/v1\/kv\/?recurse=true HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/v1\/kv\/?recurse=true HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4b4d9edde91f4be12b2018edbe89d2d2faa59054", "protocol_details": { "payload_preview": "GET \/v1\/kv\/?recurse=true HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/v1\/kv\/?recurse=true HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 30\/100", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 30 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 30, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/v1\/kv\/?recurse=true HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/v1\/kv\/?recurse=true HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "mozi_pattern", "net_consul_probe" ] }
14/07/2026 06:59:14 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 30
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /v1/status/leader HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33:8500 User-Agent: Mozilla/5.0 Connection: close Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 30 Confiance : Confiance 0 % — 6 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /v1/status/leader HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33:8500 User-Agent: Mozilla/5.0 Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 128, "payload_entropy": 5.000955059911622, "port_category": "registered", "org": "ClearStack B.V.", "service": "consul", "app_proto": "consul", "asn": 199792, "country": "NL", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 30, "tag_count": 6, "anomaly_count": 0, "campaign_key": "af9594ea6f43e1773816eda1794f59876845647a", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 30 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 199792, "org": "ClearStack B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7bebddfc37019218d65dc916538817a9", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 30 }, "payload_preview": "GET \/v1\/status\/leader HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close\r\n\r\n", "request_sample": "GET \/v1\/status\/leader HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/v1\/status\/leader HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close", "evidence": { "request_sample": "GET \/v1\/status\/leader HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/v1\/status\/leader HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0691319c65481e35322b70a0e94735f38d585018", "protocol_details": { "payload_preview": "GET \/v1\/status\/leader HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/v1\/status\/leader HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 30\/100", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 30 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 30, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/v1\/status\/leader HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/v1\/status\/leader HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "mozi_pattern", "net_consul_probe" ] }
14/07/2026 06:59:14 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 30
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /v1/kv/?recurse=true HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33:8500 User-Agent: Mozilla/5.0 Connection: close Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 30 Confiance : Confiance 0 % — 6 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /v1/kv/?recurse=true HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33:8500 User-Agent: Mozilla/5.0 Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 131, "payload_entropy": 5.082322479766562, "port_category": "registered", "org": "ClearStack B.V.", "service": "consul", "app_proto": "consul", "asn": 199792, "country": "NL", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 30, "tag_count": 6, "anomaly_count": 0, "campaign_key": "af9594ea6f43e1773816eda1794f59876845647a", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 30 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 199792, "org": "ClearStack B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0e88614b17ab09b2abcf3e996c02dfd0", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 30 }, "payload_preview": "GET \/v1\/kv\/?recurse=true HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close\r", "request_sample": "GET \/v1\/kv\/?recurse=true HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/v1\/kv\/?recurse=true HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close", "evidence": { "request_sample": "GET \/v1\/kv\/?recurse=true HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/v1\/kv\/?recurse=true HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4b4d9edde91f4be12b2018edbe89d2d2faa59054", "protocol_details": { "payload_preview": "GET \/v1\/kv\/?recurse=true HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/v1\/kv\/?recurse=true HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 30\/100", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 30 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 30, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/v1\/kv\/?recurse=true HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/v1\/kv\/?recurse=true HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Mozilla\/5.0\r\nConnection: close", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "mozi_pattern", "net_consul_probe" ] }
13/07/2026 05:59:40 UTC	TCP	5984 · COUCHDB	couchdb	couchdb probe couchdb probe · via COUCHDB:5984 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur COUCHDB WAF — Recommandation Surveiller Tags couchdb_emulated couchdb_payload http_get_probe net_couchdb_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5984 Chemin / cible — Service COUCHDB Payload GET / HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: curl/8.14.1 Accept: / Pourquoi cette classification : Type « couchdb_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 34 Confiance : Confiance 0 % — 4 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: curl/8.14.1 Accept: / Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534", "emulator_response_len": 286, "bytes_in": 79, "payload_entropy": 4.859310698323246, "port_category": "registered", "org": "ClearStack B.V.", "service": "couchdb", "app_proto": "couchdb", "asn": 199792, "country": "NL", "dst_port": 5984, "risk_waf": 8, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.6, "risk_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15 }, "risk_score": 34, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b9cfd159ba211c85f74ecb49bfdc67c2c17a2f04", "event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff", "classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 34 }, "named_classification_skipped": false, "service_name": "couchdb", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 199792, "org": "ClearStack B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "405cf9b4e63b019803030274b73d5939", "path_pattern_hash": "ce747dac2688338e030a6b5f71103175" }, "target_context": { "dst_port": 5984, "service": "couchdb", "service_name": "couchdb", "risk_score": 34 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.14.1\r\nAccept: \/\r\n\r\n", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.14.1\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.14.1\r\nAccept: \/", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.14.1\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.14.1\r\nAccept: \/", "classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ef2eceb8a85f23398cb1a2f4058075fc8883faf1", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.14.1\r\nAccept: \/", "port": 5984, "service": "couchdb", "service_label_fr": "COUCHDB" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.14.1\r\nAccept: \/", "attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)", "target_port_label": "5984 \u00b7 COUCHDB", "emulator_service": "couchdb", "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 34 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 34, "risk_label": "Faible", "service_name": "couchdb", "service_label_fr": "COUCHDB", "dst_port": 5984, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-couchdb", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.14.1\r\nAccept: \/", "port": 5984, "service": "couchdb", "service_label_fr": "COUCHDB" }, "attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.14.1\r\nAccept: \/", "target_port_label": "5984 \u00b7 COUCHDB", "emulator_service": "couchdb", "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "couchdb", "service_banner": "honeypot-couchdb", "service_os": "linux", "dst_port": "5984" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "couchdb_emulated", "couchdb_payload", "http_get_probe", "net_couchdb_probe" ] }
13/07/2026 05:59:40 UTC	TCP	5984 · COUCHDB	couchdb	couchdb probe couchdb probe · via COUCHDB:5984 · (sonde / probe)	Élevée	Moyen · 48
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole Émulateur COUCHDB WAF — Recommandation Surveiller Tags couchdb_emulated couchdb_payload couchdb_probe couchdb_rest_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5984 Chemin / cible — Service COUCHDB Payload GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: curl/8.14.1 Accept: / Pourquoi cette classification : Type « couchdb_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 48 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux Infra Couchdb Db Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: curl/8.14.1 Accept: / Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534", "emulator_response_len": 286, "bytes_in": 87, "payload_entropy": 5.021990519494916, "port_category": "registered", "org": "ClearStack B.V.", "service": "couchdb", "app_proto": "couchdb", "asn": 199792, "country": "NL", "dst_port": 5984, "risk_waf": 8, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 48, "tag_count": 6, "anomaly_count": 0, "campaign_key": "eeb24ede3f547bd086820dac13d3da57d36ee8f1", "event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff", "classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 87, "precision_signals": [ "INT-INFRA-couchdb-db", "INT-upstream" ], "kb_rule_ids": [ "INT-INFRA-couchdb-db", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 48 }, "named_classification_skipped": false, "service_name": "couchdb", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 199792, "org": "ClearStack B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1ea280c8d0a960f6663f8cdd6fc1d8d9", "path_pattern_hash": "ce747dac2688338e030a6b5f71103175" }, "target_context": { "dst_port": 5984, "service": "couchdb", "service_name": "couchdb", "risk_score": 48 }, "payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.14.1\r\nAccept: \/\r\n\r\n", "request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.14.1\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.14.1\r\nAccept: \/", "evidence": { "request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.14.1\r\nAccept: \/\r\n\r\n", "payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.14.1\r\nAccept: \/", "classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c06490c173bd9809d0edfc5a66fa0926fccdfa1a", "protocol_details": { "payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.14.1\r\nAccept: \/", "port": 5984, "service": "couchdb", "service_label_fr": "COUCHDB" }, "evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.14.1\r\nAccept: \/", "attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)", "target_port_label": "5984 \u00b7 COUCHDB", "emulator_service": "couchdb", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 48 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 48, "risk_label": "Moyen", "service_name": "couchdb", "service_label_fr": "COUCHDB", "dst_port": 5984, "protocol_emulated": true, "tags_summary": [ "INT-INFRA-couchdb-db", "INT-upstream" ], "tags_summary_labels_fr": [ "Infra Couchdb Db", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-couchdb", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.14.1\r\nAccept: \/", "port": 5984, "service": "couchdb", "service_label_fr": "COUCHDB" }, "attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: curl\/8.14.1\r\nAccept: \/", "target_port_label": "5984 \u00b7 COUCHDB", "emulator_service": "couchdb", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "couchdb", "service_banner": "honeypot-couchdb", "service_os": "linux", "dst_port": "5984" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "couchdb_emulated", "couchdb_payload", "couchdb_probe", "couchdb_rest_probe", "http_get_probe", "net_couchdb_probe" ] }
12/07/2026 12:35:52 UTC	TCP	2375 · DOCKER	docker	Sonde API Docker docker api probe · via DOCKER:2375 · (sonde / probe)	Élevée	Faible · 23
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_api_probe docker_emulated docker_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET /containers/json HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: python-requests/2.33.0 Accept-Encoding: gzip, deflate Accept Pourquoi cette classification : Type « docker_api_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 23 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /containers/json HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: python-requests/2.33.0 Accept-Encoding: gzip, deflate Accept Requête brute (extrait) GET /containers/json HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: python-requests/2.33.0 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234", "emulator_response_len": 162, "bytes_in": 161, "payload_entropy": 5.083354104394735, "port_category": "registered", "org": "ClearStack B.V.", "service": "docker", "app_proto": "docker", "asn": 199792, "country": "NL", "dst_port": 2375, "risk_waf": 8, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 23, "tag_count": 5, "anomaly_count": 0, "campaign_key": "8c1839cdbd9fa9388eb8b04668a8b57ccf5e28c3", "event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 23 }, "named_classification_skipped": false, "service_name": "docker", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 199792, "org": "ClearStack B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5ef37b2d3001fa191ae69c0ce34e0e84", "path_pattern_hash": "f1831d9f4a5a77b3112c071eb8abe3e6" }, "target_context": { "dst_port": 2375, "service": "docker", "service_name": "docker", "risk_score": 23 }, "payload_preview": "GET \/containers\/json HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept", "request_sample": "GET \/containers\/json HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/containers\/json HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept", "evidence": { "request_sample": "GET \/containers\/json HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/containers\/json HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "dce7bbe6252be2cc88456d1c34b38791ad8723ee", "protocol_details": { "payload_preview": "GET \/containers\/json HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "evidence_snippet": "GET \/containers\/json HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept", "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 23 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 23, "risk_label": "Faible", "service_name": "docker", "service_label_fr": "DOCKER", "dst_port": 2375, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Docker 24.0.5", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/containers\/json HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/containers\/json HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker", "service_banner": "Docker 24.0.5", "service_os": "linux", "dst_port": "2375" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_emulated", "docker_payload", "http_get_probe", "net_docker_api_probe" ] }
12/07/2026 05:27:17 UTC	TCP	7001 · HTTP	http	Sonde port 7001/TCP port 7001 tcp · via HTTP:7001 · (sonde / probe) · → /ldap/oid/InitialContextFactory	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET /ldap/oid/InitialContextFactory UA python-requests/2.33.0 Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950468:nosqli-3 scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET /ldap/oid/InitialContextFactory TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /ldap/oid/InitialContextFactory Preuve honeypot — Sonde port 7001/TCP Connexion détectée sur le port 7001 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « port_7001_tcp » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Moyen · 40 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /ldap/oid/InitialContextFactory HTTP/1.1` User-Agent python-requests/2.33.0 Règles WAF nosqli-3 scanner-ua Payload (extrait) GET /ldap/oid/InitialContextFactory HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: python-requests/2.33.0 Accept-Encoding: gzip, Requête brute (extrait) GET /ldap/oid/InitialContextFactory HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: python-requests/2.33.0 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": null, "http_ua_hash": "ecded1ae9fe16f9a597cb6e9d6d5e503a1334577", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "6b68cb8b79e6fea2e22e950070dfa30212f0339f", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 176, "payload_entropy": 5.145264870614115, "port_category": "registered", "org": "ClearStack B.V.", "service": "http", "app_proto": "http", "asn": 199792, "country": "NL", "dst_port": 7001, "risk_waf": 44, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 44, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 40, "tag_count": 5, "anomaly_count": 1, "campaign_key": "a419f9b22cb076200ba2abb21428f0da50046c1f", "event_fingerprint": "5abd4415e2df7b2a6df4211f475e99ec871a6262", "classification_reason": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 44, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 40 }, "named_classification_skipped": true, "named_candidate": "web_scanner", "service_name": "http", "risk_confidence_factor": 55, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 199792, "org": "ClearStack B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "03a667e9788f431ccea6ef111974e586", "payload_hash": "541dc6670f072a25e952ef75e52d2db6", "path_pattern_hash": "b4688663c44958b29e549396e220d09e" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "GET \/ldap\/oid\/InitialContextFactory HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, ", "method": "GET", "path": "\/ldap\/oid\/InitialContextFactory", "user_agent": "python-requests\/2.33.0", "waf_tags": [ "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "nosqli-3", "scanner-ua" ], "request_line": "GET \/ldap\/oid\/InitialContextFactory HTTP\/1.1", "request_sample": "GET \/ldap\/oid\/InitialContextFactory HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/ldap\/oid\/InitialContextFactory HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip,", "evidence": { "method": "GET", "path": "\/ldap\/oid\/InitialContextFactory", "user_agent": "python-requests\/2.33.0", "waf_tags": [ "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "nosqli-3", "scanner-ua" ], "request_line": "GET \/ldap\/oid\/InitialContextFactory HTTP\/1.1", "request_sample": "GET \/ldap\/oid\/InitialContextFactory HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/ldap\/oid\/InitialContextFactory HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip,", "classification_reason": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "60f889a49f6935d9f6d6db7af25de5f2427e3c3d", "protocol_details": { "http_method": "GET", "http_path": "\/ldap\/oid\/InitialContextFactory", "request_line": "GET \/ldap\/oid\/InitialContextFactory HTTP\/1.1", "http_user_agent": "python-requests\/2.33.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ldap\/oid\/InitialContextFactory HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip,", "attack_vector": "port 7001 tcp \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/ldap\/oid\/InitialContextFactory", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "classification_reason_label_fr": "Type \u00ab port_7001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 44, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/ldap\/oid\/InitialContextFactory", "request_line": "GET \/ldap\/oid\/InitialContextFactory HTTP\/1.1", "http_user_agent": "python-requests\/2.33.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port 7001 tcp \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/ldap\/oid\/InitialContextFactory", "evidence_snippet": "GET \/ldap\/oid\/InitialContextFactory HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip,", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
12/07/2026 05:27:17 UTC	TCP	7001 · WEBLOGIC	weblogic	weblogic probe weblogic probe · via WEBLOGIC:7001 · (sonde / probe)	Élevée	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBLOGIC WAF — Recommandation Surveiller Tags net_weblogic_probe tls_clienthello weblogic_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7001 Chemin / cible — Service WEBLOGIC Payload ��5�_!��,�� Q��n�!-�˚z f �z1�ۻ�ɾWK�q��U\|�j>��mu�Z"�,�0�+�/̨̩�$�(�#�'��kgu� Pourquoi cette classification :* Type « weblogic_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Faible · 33 Confiance : Confiance 77 % — 3 signal(aux) capteur Protocole émulé 1 Signaux Weblogic Console Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) STUN binding Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��5�_!��,��Q��n�!-�˚z f �z1�ۻ�ɾWK�q��U\|�j>��mu�Z"�,�0�+�/̨̩�$�(�#�'��kgu� Requête brute (extrait) ��5�_!��,�� Q��n�!-�˚z f �z1�ۻ�ɾWK�q��U\|�j>��mu�Z"�,�0�+�/̨̩�$�(�#�'��kgu� � http/1.11 64 +-3� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "bytes_in": 1513, "payload_entropy": 7.713551786771685, "port_category": "registered", "org": "ClearStack B.V.", "service": "weblogic", "app_proto": "weblogic", "asn": 199792, "country": "NL", "dst_port": 7001, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 33, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc", "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6", "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence": 0.85, "classification_confidence": 0.85, "precision_score": 87, "precision_signals": [ "INT-weblogic_console", "INT-upstream" ], "kb_rule_ids": [ "INT-weblogic_console", "INT-upstream" ], "matched_patterns": [ "pat-0771", "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "STUN binding", "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0771", "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 33, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "weblogic", "risk_confidence_factor": 77, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 199792, "org": "ClearStack B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "01ccb942fea77710369fc7df8571e171", "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3" }, "target_context": { "dst_port": 7001, "service": "weblogic", "service_name": "weblogic", "risk_score": 33 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd5\ufffd_!\ufffd\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd\u000b\ufffd\ufffdQ\ufffd\u001b\ufffdn\ufffd!-\ufffd\b\u02daz\rf \ufffdz1\u0000\ufffd\u06fb\ufffd\u027eWK\ufffdq\ufffd\ufffdU\|\ufffdj>\ufffd\ufffd\ufffd\ufffd\ufffd\u0006mu\ufffdZ\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005u\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0004\u0003\u0000\u0001", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd5\ufffd_!\ufffd\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd\u000b\ufffd\ufffdQ\ufffd\u001b\ufffdn\ufffd!-\ufffd\b\u02daz\rf \ufffdz1\u0000\ufffd\u06fb\ufffd\u027eWK\ufffdq\ufffd\ufffdU\|\ufffdj>\ufffd\ufffd\ufffd\ufffd\ufffd\u0006mu\ufffdZ\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005u\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0001\u0000\u0001\u0001\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u00006\u00004\t\u0005\t\u0006\t\u0004\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\u001a\b\u001b\b\u001c\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0004\ufffd\u0004", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd5\ufffd_!\ufffd\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd\u000b\ufffd\ufffdQ\ufffd\u001b\ufffdn\ufffd!-\ufffd\b\u02daz\rf \ufffdz1\u0000\ufffd\u06fb\ufffd\u027eWK\ufffdq\ufffd\ufffdU\|\ufffdj>\ufffd\ufffd\ufffd\ufffd\ufffd\u0006mu\ufffdZ\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005u\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0004\u0003\u0000\u0001", "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "70d4f80db8a5fb763623e10dd861e50890eef269", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd5\ufffd_!\ufffd\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd\u000b\ufffd\ufffdQ\ufffd\u001b\ufffdn\ufffd!-\ufffd\b\u02daz\rf \ufffdz1\u0000\ufffd\u06fb\ufffd\u027eWK\ufffdq\ufffd\ufffdU\|\ufffdj>\ufffd\ufffd\ufffd\ufffd\ufffd\u0006mu\ufffdZ\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005u\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0004\u0003\u0000\u0001", "port": 7001, "service": "weblogic", "service_label_fr": "WEBLOGIC" }, "evidence_snippet": "\ufffd\ufffd\ufffd5\ufffd_!\ufffd\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffdn\ufffd!-\ufffd\u02daz\rf \ufffdz1\ufffd\u06fb\ufffd\u027eWK\ufffdq\ufffd\ufffdU\|\ufffdj>\ufffd\ufffd\ufffd\ufffd\ufffdmu\ufffdZ\"\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkgu\ufffd", "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)", "target_port_label": "7001 \u00b7 WEBLOGIC", "emulator_service": "weblogic", "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 33, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 33, "risk_label": "Faible", "service_name": "weblogic", "service_label_fr": "WEBLOGIC", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "INT-weblogic_console", "INT-upstream" ], "tags_summary_labels_fr": [ "Weblogic Console", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-weblogic", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd5\ufffd_!\ufffd\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd\u000b\ufffd\ufffdQ\ufffd\u001b\ufffdn\ufffd!-\ufffd\b\u02daz\rf \ufffdz1\u0000\ufffd\u06fb\ufffd\u027eWK\ufffdq\ufffd\ufffdU\|\ufffdj>\ufffd\ufffd\ufffd\ufffd\ufffd\u0006mu\ufffdZ\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005u\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0004\u0003\u0000\u0001", "port": 7001, "service": "weblogic", "service_label_fr": "WEBLOGIC" }, "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd5\ufffd_!\ufffd\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd*Q\ufffd\ufffdn\ufffd!-\ufffd\u02daz\rf \ufffdz1\ufffd\u06fb\ufffd\u027eWK\ufffdq\ufffd\ufffdU\|\ufffdj>\ufffd\ufffd\ufffd\ufffd\ufffdmu\ufffdZ\"\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkgu\ufffd", "target_port_label": "7001 \u00b7 WEBLOGIC", "emulator_service": "weblogic", "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "weblogic", "service_banner": "honeypot-weblogic", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "weblogic" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_weblogic_probe", "tls_clienthello", "weblogic_emulated" ] }
12/07/2026 05:27:16 UTC	TCP	7001 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:7001 · (tentative d'exploit) · → /console	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole GET /console UA python-requests/2.33.0 Émulateur HTTP WAF 3 Recommandation Surveiller Tags scanner-ua anomaly:scanner-ua http_probe_console http_sensitive_path Cible HTTP GET /console TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /console Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « scanner-ua » · Sonde fichier sensible / config · confiance 97% Confiance classification 97% Risque capteur Moyen · 46 Confiance : Confiance 97 % — 1 tag(s) WAF Protocole émulé 1 Signaux Http Sensitive Upstream Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) WebLogic console path Ligne de requête `GET /console HTTP/1.1` User-Agent python-requests/2.33.0 Règles WAF scanner-ua Payload (extrait) GET /console HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: python-requests/2.33.0 Accept-Encoding: gzip, deflate Accept: / C Requête brute (extrait) GET /console HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: python-requests/2.33.0 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "ecded1ae9fe16f9a597cb6e9d6d5e503a1334577", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "61db95d7ea2dc4213a59afb0f7f4ff4180680861", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 153, "payload_entropy": 5.07219461984148, "port_category": "registered", "org": "ClearStack B.V.", "service": "http", "app_proto": "http", "asn": 199792, "country": "NL", "dst_port": 7001, "risk_waf": 20, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 6.3, "risk_breakdown": { "waf": 20, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 46, "tag_count": 6, "anomaly_count": 1, "campaign_key": "525ba95385a171768ba6176cba92e947dc38ff06", "event_fingerprint": "3c9472a0b5ba882cf84df5beafef8376a6ca310d", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%", "confidence": 0.97, "classification_confidence": 0.97, "precision_score": 97, "precision_signals": [ "INT-http_sensitive", "INT-upstream" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream" ], "matched_patterns": [ "pat-0601" ], "matched_pattern_names": [ "WebLogic console path" ], "pattern_ids": [ "pat-0601" ], "confidence_breakdown": { "waf": 20, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 46 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 97, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 199792, "org": "ClearStack B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "03a667e9788f431ccea6ef111974e586", "payload_hash": "2bba59f509fe012545ee45c54b80c4b8", "path_pattern_hash": "cf882ecf15cdcf4962eac23c843871fe" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 46 }, "payload_preview": "GET \/console HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nC", "method": "GET", "path": "\/console", "user_agent": "python-requests\/2.33.0", "waf_tags": [ "scanner-ua" ], "waf_rule_names": [ "scanner-ua" ], "request_line": "GET \/console HTTP\/1.1", "request_sample": "GET \/console HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/console HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nC", "evidence": { "method": "GET", "path": "\/console", "user_agent": "python-requests\/2.33.0", "waf_tags": [ "scanner-ua" ], "waf_rule_names": [ "scanner-ua" ], "request_line": "GET \/console HTTP\/1.1", "request_sample": "GET \/console HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/console HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nC", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9e18b23de9a84c835491aec5987e22b6fb98672f", "protocol_details": { "http_method": "GET", "http_path": "\/console", "request_line": "GET \/console HTTP\/1.1", "http_user_agent": "python-requests\/2.33.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/console HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nC", "attack_vector": "config file probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/console", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 97 % \u2014 via HTTP", "confidence_pct": 97, "confidence_breakdown": { "waf": 20, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "INT-http_sensitive", "INT-upstream" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/console", "request_line": "GET \/console HTTP\/1.1", "http_user_agent": "python-requests\/2.33.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/console", "evidence_snippet": "GET \/console HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nC", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF", "confidence_factors_fr": "Confiance 97 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "anomaly:scanner-ua", "http_probe_console", "http_sensitive_path", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
11/07/2026 13:27:07 UTC	TCP	7001 · HTTP	http	weblogic probe weblogic probe · via HTTP:7001 · (sonde / probe) · → /console/j_security_check	Élevée	Moyen · 42
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET /console/j_security_check UA python-requests/2.33.0 Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950468:nosqli-3 scanner-ua anomaly:scanner-ua http_probe_console Cible HTTP GET /console/j_security_check TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /console/j_security_check Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Moyen · 42 Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF Protocole émulé 1 Signaux pat-0857 pat-0601 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) ET WebLogic console WebLogic console path Probe /console/ Ligne de requête `GET /console/j_security_check HTTP/1.1` User-Agent python-requests/2.33.0 Règles WAF nosqli-3 scanner-ua Payload (extrait) GET /console/j_security_check HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: python-requests/2.33.0 Accept-Encoding: gzip, deflat Requête brute (extrait) GET /console/j_security_check HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: python-requests/2.33.0 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "ecded1ae9fe16f9a597cb6e9d6d5e503a1334577", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "763dd7303f8af7f5317bc8236f00c1c871de6421", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 170, "payload_entropy": 5.134075464473577, "port_category": "registered", "org": "ClearStack B.V.", "service": "http", "app_proto": "http", "asn": 199792, "country": "NL", "dst_port": 7001, "risk_waf": 44, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 6.6, "risk_breakdown": { "waf": 44, "classification": 58, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 42, "tag_count": 7, "anomaly_count": 1, "campaign_key": "4e98a8ef52d488da384c3ec1b2d457267347ffcc", "event_fingerprint": "1827b0619aceb4bdf7e51503852c74b03f7671b3", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 124, "precision_signals": [ "pat-0857", "pat-0601" ], "kb_rule_ids": [ "pat-0857", "pat-0601" ], "matched_patterns": [ "pat-0857", "pat-0601", "pat-0248" ], "matched_pattern_names": [ "ET WebLogic console", "WebLogic console path", "Probe \/console\/" ], "pattern_ids": [ "pat-0857", "pat-0601", "pat-0248" ], "confidence_breakdown": { "waf": 44, "classification": 58, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 42 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 199792, "org": "ClearStack B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "03a667e9788f431ccea6ef111974e586", "payload_hash": "a11f84e44074730d956a9a0cb22aae23", "path_pattern_hash": "dce0cf7e4a7d41f71a6fb88c9326634e" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflat", "method": "GET", "path": "\/console\/j_security_check", "user_agent": "python-requests\/2.33.0", "waf_tags": [ "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "nosqli-3", "scanner-ua" ], "request_line": "GET \/console\/j_security_check HTTP\/1.1", "request_sample": "GET \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflat", "evidence": { "method": "GET", "path": "\/console\/j_security_check", "user_agent": "python-requests\/2.33.0", "waf_tags": [ "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "nosqli-3", "scanner-ua" ], "request_line": "GET \/console\/j_security_check HTTP\/1.1", "request_sample": "GET \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflat", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "23c2effbd41486cf51f0cee6c135370cb4d8debc", "protocol_details": { "http_method": "GET", "http_path": "\/console\/j_security_check", "request_line": "GET \/console\/j_security_check HTTP\/1.1", "http_user_agent": "python-requests\/2.33.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflat", "attack_vector": "weblogic probe \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/console\/j_security_check", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 58, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 42 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "pat-0857", "pat-0601" ], "tags_summary_labels_fr": [ "pat-0857", "pat-0601" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/console\/j_security_check", "request_line": "GET \/console\/j_security_check HTTP\/1.1", "http_user_agent": "python-requests\/2.33.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "weblogic probe \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/console\/j_security_check", "evidence_snippet": "GET \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflat", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3", "anomaly:scanner-ua", "http_probe_console", "http_sensitive_path", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
11/07/2026 13:27:07 UTC	TCP	7001 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:7001 · (tentative d'exploit) · → /console/j_security_check	Élevée	Moyen · 56
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole POST /console/j_security_check UA python-requests/2.33.0 Émulateur HTTP WAF 16 Recommandation Investiguer Tags 950327:rce-0 950468:nosqli-3 scanner-ua anomaly:scanner-ua Cible HTTP POST /console/j_security_check TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 7001 Chemin / cible /console/j_security_check Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Moyen · 56 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL ET WebLogic console WebLogic console path Probe /console/ Ligne de requête `POST /console/j_security_check HTTP/1.1` User-Agent python-requests/2.33.0 Règles WAF rce-0 nosqli-3 scanner-ua Payload (extrait) POST /console/j_security_check HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: python-requests/2.33.0 Accept-Encoding: gzip, defla Requête brute (extrait) POST /console/j_security_check HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: python-requests/2.33.0 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Content-Length: 66 Content-Type: application/x-www-form-urlencoded j_username=weblo Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "ecded1ae9fe16f9a597cb6e9d6d5e503a1334577", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "763dd7303f8af7f5317bc8236f00c1c871de6421", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 306, "payload_entropy": 5.277543402531046, "port_category": "registered", "org": "ClearStack B.V.", "service": "http", "app_proto": "http", "asn": 199792, "country": "NL", "dst_port": 7001, "risk_waf": 72, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 7.2, "risk_breakdown": { "waf": 72, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 56, "tag_count": 9, "anomaly_count": 1, "campaign_key": "7e9ae434d8a17ae4366b2efc72df282b8238470b", "event_fingerprint": "1827b0619aceb4bdf7e51503852c74b03f7671b3", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 127, "precision_signals": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0842", "pat-0857", "pat-0601", "pat-0248" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "ET WebLogic console", "WebLogic console path", "Probe \/console\/" ], "pattern_ids": [ "pat-0842", "pat-0857", "pat-0601", "pat-0248" ], "confidence_breakdown": { "waf": 72, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 56 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 199792, "org": "ClearStack B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "03a667e9788f431ccea6ef111974e586", "payload_hash": "816f43323143008f4abbb6270159003e", "path_pattern_hash": "dce0cf7e4a7d41f71a6fb88c9326634e" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 56 }, "payload_preview": "POST \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, defla", "method": "POST", "path": "\/console\/j_security_check", "user_agent": "python-requests\/2.33.0", "waf_tags": [ "950327:rce-0", "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "nosqli-3", "scanner-ua" ], "request_line": "POST \/console\/j_security_check HTTP\/1.1", "request_sample": "POST \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\nContent-Length: 66\r\nContent-Type: application\/x-www-form-urlencoded\r\n\r\nj_username=weblo", "payload_snippet": "POST \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, defla", "evidence": { "method": "POST", "path": "\/console\/j_security_check", "user_agent": "python-requests\/2.33.0", "waf_tags": [ "950327:rce-0", "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "nosqli-3", "scanner-ua" ], "request_line": "POST \/console\/j_security_check HTTP\/1.1", "request_sample": "POST \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\nContent-Length: 66\r\nContent-Type: application\/x-www-form-urlencoded\r\n\r\nj_username=weblo", "payload_snippet": "POST \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, defla", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "75f181fc73d00f849889a331f76bf1ab4bb970d4", "protocol_details": { "http_method": "POST", "http_path": "\/console\/j_security_check", "request_line": "POST \/console\/j_security_check HTTP\/1.1", "http_user_agent": "python-requests\/2.33.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, defla", "attack_vector": "config file probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/console\/j_security_check", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 72, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 56 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 56, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/console\/j_security_check", "request_line": "POST \/console\/j_security_check HTTP\/1.1", "http_user_agent": "python-requests\/2.33.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/console\/j_security_check", "evidence_snippet": "POST \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, defla", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950327:rce-0", "950468:nosqli-3", "anomaly:scanner-ua", "http_credential_body", "http_probe_console", "http_sensitive_path", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
11/07/2026 13:27:07 UTC	TCP	7001 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:7001 · (tentative d'exploit) · → /console/j_security_check	Élevée	Moyen · 56
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole POST /console/j_security_check UA python-requests/2.33.0 Émulateur HTTP WAF 16 Recommandation Investiguer Tags 950327:rce-0 950468:nosqli-3 scanner-ua anomaly:scanner-ua Cible HTTP POST /console/j_security_check TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 7001 Chemin / cible /console/j_security_check Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Moyen · 56 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL ET WebLogic console WebLogic console path Probe /console/ Ligne de requête `POST /console/j_security_check HTTP/1.1` User-Agent python-requests/2.33.0 Règles WAF rce-0 nosqli-3 scanner-ua Payload (extrait) POST /console/j_security_check HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: python-requests/2.33.0 Accept-Encoding: gzip, defla Requête brute (extrait) POST /console/j_security_check HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: python-requests/2.33.0 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Content-Length: 69 Content-Type: application/x-www-form-urlencoded j_username=weblo Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "ecded1ae9fe16f9a597cb6e9d6d5e503a1334577", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "763dd7303f8af7f5317bc8236f00c1c871de6421", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 309, "payload_entropy": 5.297425339499269, "port_category": "registered", "org": "ClearStack B.V.", "service": "http", "app_proto": "http", "asn": 199792, "country": "NL", "dst_port": 7001, "risk_waf": 72, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 7.2, "risk_breakdown": { "waf": 72, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 56, "tag_count": 9, "anomaly_count": 1, "campaign_key": "7e9ae434d8a17ae4366b2efc72df282b8238470b", "event_fingerprint": "1827b0619aceb4bdf7e51503852c74b03f7671b3", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 127, "precision_signals": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0842", "pat-0857", "pat-0601", "pat-0248" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "ET WebLogic console", "WebLogic console path", "Probe \/console\/" ], "pattern_ids": [ "pat-0842", "pat-0857", "pat-0601", "pat-0248" ], "confidence_breakdown": { "waf": 72, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 56 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 199792, "org": "ClearStack B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "03a667e9788f431ccea6ef111974e586", "payload_hash": "049ba4e9b3ff25ae19088e8912e2ab44", "path_pattern_hash": "dce0cf7e4a7d41f71a6fb88c9326634e" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 56 }, "payload_preview": "POST \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, defla", "method": "POST", "path": "\/console\/j_security_check", "user_agent": "python-requests\/2.33.0", "waf_tags": [ "950327:rce-0", "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "nosqli-3", "scanner-ua" ], "request_line": "POST \/console\/j_security_check HTTP\/1.1", "request_sample": "POST \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\nContent-Length: 69\r\nContent-Type: application\/x-www-form-urlencoded\r\n\r\nj_username=weblo", "payload_snippet": "POST \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, defla", "evidence": { "method": "POST", "path": "\/console\/j_security_check", "user_agent": "python-requests\/2.33.0", "waf_tags": [ "950327:rce-0", "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "nosqli-3", "scanner-ua" ], "request_line": "POST \/console\/j_security_check HTTP\/1.1", "request_sample": "POST \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\nContent-Length: 69\r\nContent-Type: application\/x-www-form-urlencoded\r\n\r\nj_username=weblo", "payload_snippet": "POST \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, defla", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a347bed2ff4b660cf0c0163e6c49569fc29a92c6", "protocol_details": { "http_method": "POST", "http_path": "\/console\/j_security_check", "request_line": "POST \/console\/j_security_check HTTP\/1.1", "http_user_agent": "python-requests\/2.33.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, defla", "attack_vector": "config file probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/console\/j_security_check", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 72, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 56 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 56, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/console\/j_security_check", "request_line": "POST \/console\/j_security_check HTTP\/1.1", "http_user_agent": "python-requests\/2.33.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/console\/j_security_check", "evidence_snippet": "POST \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, defla", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950327:rce-0", "950468:nosqli-3", "anomaly:scanner-ua", "http_credential_body", "http_probe_console", "http_sensitive_path", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
11/07/2026 13:27:07 UTC	TCP	7001 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:7001 · (tentative d'exploit) · → /console/j_security_check	Élevée	Moyen · 56
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole POST /console/j_security_check UA python-requests/2.33.0 Émulateur HTTP WAF 16 Recommandation Investiguer Tags 950327:rce-0 950468:nosqli-3 scanner-ua anomaly:scanner-ua Cible HTTP POST /console/j_security_check TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 7001 Chemin / cible /console/j_security_check Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Moyen · 56 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL ET WebLogic console WebLogic console path Probe /console/ Ligne de requête `POST /console/j_security_check HTTP/1.1` User-Agent python-requests/2.33.0 Règles WAF rce-0 nosqli-3 scanner-ua Payload (extrait) POST /console/j_security_check HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: python-requests/2.33.0 Accept-Encoding: gzip, defla Requête brute (extrait) POST /console/j_security_check HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: python-requests/2.33.0 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Content-Length: 70 Content-Type: application/x-www-form-urlencoded j_username=weblo Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "ecded1ae9fe16f9a597cb6e9d6d5e503a1334577", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "763dd7303f8af7f5317bc8236f00c1c871de6421", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 310, "payload_entropy": 5.316194532085052, "port_category": "registered", "org": "ClearStack B.V.", "service": "http", "app_proto": "http", "asn": 199792, "country": "NL", "dst_port": 7001, "risk_waf": 72, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 7.2, "risk_breakdown": { "waf": 72, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 56, "tag_count": 9, "anomaly_count": 1, "campaign_key": "7e9ae434d8a17ae4366b2efc72df282b8238470b", "event_fingerprint": "1827b0619aceb4bdf7e51503852c74b03f7671b3", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 127, "precision_signals": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0842", "pat-0857", "pat-0601", "pat-0248" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "ET WebLogic console", "WebLogic console path", "Probe \/console\/" ], "pattern_ids": [ "pat-0842", "pat-0857", "pat-0601", "pat-0248" ], "confidence_breakdown": { "waf": 72, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 56 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 199792, "org": "ClearStack B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "03a667e9788f431ccea6ef111974e586", "payload_hash": "0c78d40a8dcc1b5286ce7af21fa78b2d", "path_pattern_hash": "dce0cf7e4a7d41f71a6fb88c9326634e" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 56 }, "payload_preview": "POST \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, defla", "method": "POST", "path": "\/console\/j_security_check", "user_agent": "python-requests\/2.33.0", "waf_tags": [ "950327:rce-0", "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "nosqli-3", "scanner-ua" ], "request_line": "POST \/console\/j_security_check HTTP\/1.1", "request_sample": "POST \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\nContent-Length: 70\r\nContent-Type: application\/x-www-form-urlencoded\r\n\r\nj_username=weblo", "payload_snippet": "POST \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, defla", "evidence": { "method": "POST", "path": "\/console\/j_security_check", "user_agent": "python-requests\/2.33.0", "waf_tags": [ "950327:rce-0", "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "nosqli-3", "scanner-ua" ], "request_line": "POST \/console\/j_security_check HTTP\/1.1", "request_sample": "POST \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\nContent-Length: 70\r\nContent-Type: application\/x-www-form-urlencoded\r\n\r\nj_username=weblo", "payload_snippet": "POST \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, defla", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "88651e24ec11b259d3575036cb083f329eccc907", "protocol_details": { "http_method": "POST", "http_path": "\/console\/j_security_check", "request_line": "POST \/console\/j_security_check HTTP\/1.1", "http_user_agent": "python-requests\/2.33.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, defla", "attack_vector": "config file probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/console\/j_security_check", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 72, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 56 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 56, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/console\/j_security_check", "request_line": "POST \/console\/j_security_check HTTP\/1.1", "http_user_agent": "python-requests\/2.33.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/console\/j_security_check", "evidence_snippet": "POST \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, defla", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950327:rce-0", "950468:nosqli-3", "anomaly:scanner-ua", "http_credential_body", "http_probe_console", "http_sensitive_path", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
11/07/2026 13:27:07 UTC	TCP	7001 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:7001 · (tentative d'exploit) · → /console/j_security_check	Élevée	Moyen · 56
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole POST /console/j_security_check UA python-requests/2.33.0 Émulateur HTTP WAF 16 Recommandation Investiguer Tags 950327:rce-0 950468:nosqli-3 scanner-ua anomaly:scanner-ua Cible HTTP POST /console/j_security_check TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 7001 Chemin / cible /console/j_security_check Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Moyen · 56 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL ET WebLogic console WebLogic console path Probe /console/ Ligne de requête `POST /console/j_security_check HTTP/1.1` User-Agent python-requests/2.33.0 Règles WAF rce-0 nosqli-3 scanner-ua Payload (extrait) POST /console/j_security_check HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: python-requests/2.33.0 Accept-Encoding: gzip, defla Requête brute (extrait) POST /console/j_security_check HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: python-requests/2.33.0 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Content-Length: 67 Content-Type: application/x-www-form-urlencoded j_username=weblo Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "ecded1ae9fe16f9a597cb6e9d6d5e503a1334577", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "763dd7303f8af7f5317bc8236f00c1c871de6421", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 307, "payload_entropy": 5.283845256819282, "port_category": "registered", "org": "ClearStack B.V.", "service": "http", "app_proto": "http", "asn": 199792, "country": "NL", "dst_port": 7001, "risk_waf": 72, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 7.2, "risk_breakdown": { "waf": 72, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 56, "tag_count": 9, "anomaly_count": 1, "campaign_key": "7e9ae434d8a17ae4366b2efc72df282b8238470b", "event_fingerprint": "1827b0619aceb4bdf7e51503852c74b03f7671b3", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 127, "precision_signals": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0842", "pat-0857", "pat-0601", "pat-0248" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "ET WebLogic console", "WebLogic console path", "Probe \/console\/" ], "pattern_ids": [ "pat-0842", "pat-0857", "pat-0601", "pat-0248" ], "confidence_breakdown": { "waf": 72, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 56 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 199792, "org": "ClearStack B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "03a667e9788f431ccea6ef111974e586", "payload_hash": "47d6e9765ed834306382131d93bfc613", "path_pattern_hash": "dce0cf7e4a7d41f71a6fb88c9326634e" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 56 }, "payload_preview": "POST \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, defla", "method": "POST", "path": "\/console\/j_security_check", "user_agent": "python-requests\/2.33.0", "waf_tags": [ "950327:rce-0", "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "nosqli-3", "scanner-ua" ], "request_line": "POST \/console\/j_security_check HTTP\/1.1", "request_sample": "POST \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\nContent-Length: 67\r\nContent-Type: application\/x-www-form-urlencoded\r\n\r\nj_username=weblo", "payload_snippet": "POST \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, defla", "evidence": { "method": "POST", "path": "\/console\/j_security_check", "user_agent": "python-requests\/2.33.0", "waf_tags": [ "950327:rce-0", "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "rce-0", "nosqli-3", "scanner-ua" ], "request_line": "POST \/console\/j_security_check HTTP\/1.1", "request_sample": "POST \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\nContent-Length: 67\r\nContent-Type: application\/x-www-form-urlencoded\r\n\r\nj_username=weblo", "payload_snippet": "POST \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, defla", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2867c2eb283e4aeb946311c58b5aae9029c04345", "protocol_details": { "http_method": "POST", "http_path": "\/console\/j_security_check", "request_line": "POST \/console\/j_security_check HTTP\/1.1", "http_user_agent": "python-requests\/2.33.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, defla", "attack_vector": "config file probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/console\/j_security_check", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 72, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 56 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 56, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/console\/j_security_check", "request_line": "POST \/console\/j_security_check HTTP\/1.1", "http_user_agent": "python-requests\/2.33.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/console\/j_security_check", "evidence_snippet": "POST \/console\/j_security_check HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, defla", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950327:rce-0", "950468:nosqli-3", "anomaly:scanner-ua", "http_credential_body", "http_probe_console", "http_sensitive_path", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
11/07/2026 13:26:44 UTC	TCP	7001 · HTTP	http	Traversal LFI lfi path traversal · via HTTP:7001 · (tentative d'exploit) · → /wls-wsat/CoordinatorPortType	Élevée	Critique · 100
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole POST /wls-wsat/CoordinatorPortType UA python-requests/2.33.0 Émulateur HTTP WAF 79 Recommandation Bloquer (recommandé) Tags 950079:sqli-19 950267:lfi-1 950319:lfi-14 950327:rce-0 Cible HTTP POST /wls-wsat/CoordinatorPortType TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 7001 Chemin / cible /wls-wsat/CoordinatorPortType Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 100% Confiance classification 100% Risque capteur Critique · 100 Confiance : Confiance 100 % — 12 tag(s) WAF Protocole émulé 1 Signaux CRS-930100-sub Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL WebLogic wls-wsat CRS 932200 CRS 932205 CRS 941130 Ligne de requête `POST /wls-wsat/CoordinatorPortType HTTP/1.1` User-Agent python-requests/2.33.0 Règles WAF sqli-19 lfi-1 lfi-14 rce-0 rce-14 ssrf-0 ssrf-3 nosqli-3 cloud-openstack-md ssrf-linklocal scanner-ua Payload (extrait) POST /wls-wsat/CoordinatorPortType HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: python-requests/2.33.0 Accept-Encoding: gzip, d Requête brute (extrait) POST /wls-wsat/CoordinatorPortType HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: python-requests/2.33.0 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Content-Type: text/xml Content-Length: 765 <soapenv:Envelope xmlns:soapenv="htt Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "ecded1ae9fe16f9a597cb6e9d6d5e503a1334577", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "99e47b274371fad76141ed1627f3bcdf29dce19a", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 985, "payload_entropy": 5.150862918682665, "port_category": "registered", "org": "ClearStack B.V.", "service": "http", "app_proto": "http", "asn": 199792, "country": "NL", "dst_port": 7001, "risk_waf": 100, "risk_classification": 78, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 45, "risk_granularity": 7.2, "risk_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 100, "tag_count": 22, "anomaly_count": 1, "campaign_key": "ad3febcd30315f728a7b6768e510b8dd179dfc01", "event_fingerprint": "e444dfd56f7cf7dfce78a017248baf6c57b64aa5", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 140, "precision_signals": [ "CRS-930100-sub" ], "kb_rule_ids": [ "CRS-930100-sub" ], "matched_patterns": [ "pat-0842", "pat-0602", "pat-0145", "pat-0146", "pat-0284" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "WebLogic wls-wsat", "CRS 932200", "CRS 932205", "CRS 941130" ], "pattern_ids": [ "pat-0842", "pat-0602", "pat-0145", "pat-0146", "pat-0284" ], "confidence_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 100 }, "named_classification_skipped": false, "classification_parent": "path_traversal", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 199792, "org": "ClearStack B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "03a667e9788f431ccea6ef111974e586", "payload_hash": "7a163bdb749b74cebc89b63d5ce8bf11", "path_pattern_hash": "16111671401e187b64b702a8ecb56bdf" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 100 }, "payload_preview": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, d", "method": "POST", "path": "\/wls-wsat\/CoordinatorPortType", "user_agent": "python-requests\/2.33.0", "waf_tags": [ "950079:sqli-19", "950267:lfi-1", "950319:lfi-14", "950327:rce-0", "950383:rce-14", "950395:ssrf-0", "950407:ssrf-3", "950468:nosqli-3", "950471:nosqli-3", "950596:cloud-openstack-md", "951002:ssrf-linklocal", "scanner-ua" ], "waf_rule_names": [ "sqli-19", "lfi-1", "lfi-14", "rce-0", "rce-14", "ssrf-0", "ssrf-3", "nosqli-3", "cloud-openstack-md", "ssrf-linklocal", "scanner-ua" ], "request_line": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1", "request_sample": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\nContent-Type: text\/xml\r\nContent-Length: 765\r\n\r\n<soapenv:Envelope xmlns:soapenv=\"htt", "payload_snippet": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, d", "evidence": { "method": "POST", "path": "\/wls-wsat\/CoordinatorPortType", "user_agent": "python-requests\/2.33.0", "waf_tags": [ "950079:sqli-19", "950267:lfi-1", "950319:lfi-14", "950327:rce-0", "950383:rce-14", "950395:ssrf-0", "950407:ssrf-3", "950468:nosqli-3", "950471:nosqli-3", "950596:cloud-openstack-md", "951002:ssrf-linklocal", "scanner-ua" ], "waf_rule_names": [ "sqli-19", "lfi-1", "lfi-14", "rce-0", "rce-14", "ssrf-0", "ssrf-3", "nosqli-3", "cloud-openstack-md", "ssrf-linklocal", "scanner-ua" ], "request_line": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1", "request_sample": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\nContent-Type: text\/xml\r\nContent-Length: 765\r\n\r\n<soapenv:Envelope xmlns:soapenv=\"htt", "payload_snippet": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, d", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "ssrf_probe" ], "recommended_client_action": "block", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "486d07ef31e02cc3512dc5450e168d2aa40772f5", "protocol_details": { "http_method": "POST", "http_path": "\/wls-wsat\/CoordinatorPortType", "request_line": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1", "http_user_agent": "python-requests\/2.33.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, d", "attack_vector": "lfi path traversal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wls-wsat\/CoordinatorPortType", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 12 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 100%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 100\/100 (Critique) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 100 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 100, "risk_label": "Critique", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "CRS-930100-sub" ], "tags_summary_labels_fr": [ "CRS-930100-sub" ], "recommended_action": "block", "recommended_action_label": "Bloquer (recommand\u00e9)", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/wls-wsat\/CoordinatorPortType", "request_line": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1", "http_user_agent": "python-requests\/2.33.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "lfi path traversal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wls-wsat\/CoordinatorPortType", "evidence_snippet": "POST \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, d", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 12 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 12 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_block", "tags_list": [ "950079:sqli-19", "950267:lfi-1", "950319:lfi-14", "950327:rce-0", "950383:rce-14", "950395:ssrf-0", "950407:ssrf-3", "950468:nosqli-3", "950471:nosqli-3", "950596:cloud-openstack-md", "951002:ssrf-linklocal", "anomaly:scanner-ua", "http_aws_imds_probe", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_probe_weblogic_wls", "http_ssrf_body", "http_ssrf_cloud_metadata", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
11/07/2026 13:26:44 UTC	TCP	7001 · HTTP	http	Traversal LFI lfi path traversal · via HTTP:7001 · (tentative d'exploit) · → /_async/AsyncResponseService	Élevée	Critique · 100
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole POST /_async/AsyncResponseService UA python-requests/2.33.0 Émulateur HTTP WAF 79 Recommandation Bloquer (recommandé) Tags 950079:sqli-19 950267:lfi-1 950319:lfi-14 950327:rce-0 Cible HTTP POST /_async/AsyncResponseService TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 7001 Chemin / cible /_async/AsyncResponseService Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 100% Confiance classification 100% Risque capteur Critique · 100 Confiance : Confiance 100 % — 12 tag(s) WAF Protocole émulé 1 Signaux CRS-930100-sub Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CVE-2019-2725 WebLogic CVE-2019-2725 CRS 932200 CRS 932205 CRS 941130 Ligne de requête `POST /_async/AsyncResponseService HTTP/1.1` User-Agent python-requests/2.33.0 Règles WAF sqli-19 lfi-1 lfi-14 rce-0 rce-14 ssrf-0 ssrf-3 nosqli-3 cloud-openstack-md ssrf-linklocal scanner-ua Payload (extrait) POST /_async/AsyncResponseService HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: python-requests/2.33.0 Accept-Encoding: gzip, de Requête brute (extrait) POST /_async/AsyncResponseService HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: python-requests/2.33.0 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Content-Type: text/xml Content-Length: 765 <soapenv:Envelope xmlns:soapenv="http Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "ecded1ae9fe16f9a597cb6e9d6d5e503a1334577", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "5f607796f47a9c4deebf8fbd05129012563f96fa", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 984, "payload_entropy": 5.15792218465303, "port_category": "registered", "org": "ClearStack B.V.", "service": "http", "app_proto": "http", "asn": 199792, "country": "NL", "dst_port": 7001, "risk_waf": 100, "risk_classification": 78, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 45, "risk_granularity": 7.2, "risk_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 100, "tag_count": 21, "anomaly_count": 1, "campaign_key": "065c7f44f1fed6043d7c1b9fc50487c436dc3fd7", "event_fingerprint": "71c9d649a657c75fc8f876bf543423d1d6f54d4d", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 140, "precision_signals": [ "CRS-930100-sub" ], "kb_rule_ids": [ "CRS-930100-sub" ], "matched_patterns": [ "pat-0842", "pat-0179", "pat-0145", "pat-0146", "pat-0284" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CVE-2019-2725 WebLogic CVE-2019-2725", "CRS 932200", "CRS 932205", "CRS 941130" ], "pattern_ids": [ "pat-0842", "pat-0179", "pat-0145", "pat-0146", "pat-0284" ], "confidence_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 100 }, "named_classification_skipped": false, "classification_parent": "path_traversal", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 199792, "org": "ClearStack B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "03a667e9788f431ccea6ef111974e586", "payload_hash": "6f15b63398c36632ae09bf7e0f39a18f", "path_pattern_hash": "01bc2c025b7f327650e4a8ec8490febd" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 100 }, "payload_preview": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, de", "method": "POST", "path": "\/_async\/AsyncResponseService", "user_agent": "python-requests\/2.33.0", "waf_tags": [ "950079:sqli-19", "950267:lfi-1", "950319:lfi-14", "950327:rce-0", "950383:rce-14", "950395:ssrf-0", "950407:ssrf-3", "950468:nosqli-3", "950471:nosqli-3", "950596:cloud-openstack-md", "951002:ssrf-linklocal", "scanner-ua" ], "waf_rule_names": [ "sqli-19", "lfi-1", "lfi-14", "rce-0", "rce-14", "ssrf-0", "ssrf-3", "nosqli-3", "cloud-openstack-md", "ssrf-linklocal", "scanner-ua" ], "request_line": "POST \/_async\/AsyncResponseService HTTP\/1.1", "request_sample": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\nContent-Type: text\/xml\r\nContent-Length: 765\r\n\r\n<soapenv:Envelope xmlns:soapenv=\"http", "payload_snippet": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, de", "evidence": { "method": "POST", "path": "\/_async\/AsyncResponseService", "user_agent": "python-requests\/2.33.0", "waf_tags": [ "950079:sqli-19", "950267:lfi-1", "950319:lfi-14", "950327:rce-0", "950383:rce-14", "950395:ssrf-0", "950407:ssrf-3", "950468:nosqli-3", "950471:nosqli-3", "950596:cloud-openstack-md", "951002:ssrf-linklocal", "scanner-ua" ], "waf_rule_names": [ "sqli-19", "lfi-1", "lfi-14", "rce-0", "rce-14", "ssrf-0", "ssrf-3", "nosqli-3", "cloud-openstack-md", "ssrf-linklocal", "scanner-ua" ], "request_line": "POST \/_async\/AsyncResponseService HTTP\/1.1", "request_sample": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\nContent-Type: text\/xml\r\nContent-Length: 765\r\n\r\n<soapenv:Envelope xmlns:soapenv=\"http", "payload_snippet": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, de", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "ssrf_probe" ], "recommended_client_action": "block", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1dedb2b9afd6c59b06008fefccd14ee004026bd4", "protocol_details": { "http_method": "POST", "http_path": "\/_async\/AsyncResponseService", "request_line": "POST \/_async\/AsyncResponseService HTTP\/1.1", "http_user_agent": "python-requests\/2.33.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, de", "attack_vector": "lfi path traversal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_async\/AsyncResponseService", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 12 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 100%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 100\/100 (Critique) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 100 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 100, "risk_label": "Critique", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "CRS-930100-sub" ], "tags_summary_labels_fr": [ "CRS-930100-sub" ], "recommended_action": "block", "recommended_action_label": "Bloquer (recommand\u00e9)", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/_async\/AsyncResponseService", "request_line": "POST \/_async\/AsyncResponseService HTTP\/1.1", "http_user_agent": "python-requests\/2.33.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "lfi path traversal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_async\/AsyncResponseService", "evidence_snippet": "POST \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, de", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 12 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 12 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_block", "tags_list": [ "950079:sqli-19", "950267:lfi-1", "950319:lfi-14", "950327:rce-0", "950383:rce-14", "950395:ssrf-0", "950407:ssrf-3", "950468:nosqli-3", "950471:nosqli-3", "950596:cloud-openstack-md", "951002:ssrf-linklocal", "anomaly:scanner-ua", "http_aws_imds_probe", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ssrf_body", "http_ssrf_cloud_metadata", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
11/07/2026 13:26:00 UTC	TCP	7001 · HTTP	http	weblogic probe weblogic probe · via HTTP:7001 · (sonde / probe) · → /console/login/LoginForm.jsp	Élevée	Moyen · 42
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET /console/login/LoginForm.jsp UA python-requests/2.33.0 Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950468:nosqli-3 scanner-ua anomaly:scanner-ua http_probe_console Cible HTTP GET /console/login/LoginForm.jsp TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /console/login/LoginForm.jsp Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Moyen · 42 Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF Protocole émulé 1 Signaux pat-0857 pat-0601 pat-0741 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) ET WebLogic console WebLogic console path WebLogic cluster Probe /console/ Ligne de requête `GET /console/login/LoginForm.jsp HTTP/1.1` User-Agent python-requests/2.33.0 Règles WAF nosqli-3 scanner-ua Payload (extrait) GET /console/login/LoginForm.jsp HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: python-requests/2.33.0 Accept-Encoding: gzip, def Requête brute (extrait) GET /console/login/LoginForm.jsp HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: python-requests/2.33.0 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": "jsp", "http_ua_hash": "ecded1ae9fe16f9a597cb6e9d6d5e503a1334577", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "5888115b723eebf74cff3715c1e79014c6b93e9b", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 173, "payload_entropy": 5.140189371969924, "port_category": "registered", "org": "ClearStack B.V.", "service": "http", "app_proto": "http", "asn": 199792, "country": "NL", "dst_port": 7001, "risk_waf": 44, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 6.6, "risk_breakdown": { "waf": 44, "classification": 58, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 42, "tag_count": 7, "anomaly_count": 1, "campaign_key": "4e98a8ef52d488da384c3ec1b2d457267347ffcc", "event_fingerprint": "0bcd546adc3e0517be88d49a165ab6f8019f83ae", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 182, "precision_signals": [ "pat-0857", "pat-0601", "pat-0741" ], "kb_rule_ids": [ "pat-0857", "pat-0601", "pat-0741" ], "matched_patterns": [ "pat-0857", "pat-0601", "pat-0741", "pat-0248" ], "matched_pattern_names": [ "ET WebLogic console", "WebLogic console path", "WebLogic cluster", "Probe \/console\/" ], "pattern_ids": [ "pat-0857", "pat-0601", "pat-0741", "pat-0248" ], "confidence_breakdown": { "waf": 44, "classification": 58, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 42 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 199792, "org": "ClearStack B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "03a667e9788f431ccea6ef111974e586", "payload_hash": "0092b64e4b601bb258276171605db6c8", "path_pattern_hash": "787be5555f9e6e61f95410bb9176809f" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, def", "method": "GET", "path": "\/console\/login\/LoginForm.jsp", "user_agent": "python-requests\/2.33.0", "waf_tags": [ "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "nosqli-3", "scanner-ua" ], "request_line": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1", "request_sample": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, def", "evidence": { "method": "GET", "path": "\/console\/login\/LoginForm.jsp", "user_agent": "python-requests\/2.33.0", "waf_tags": [ "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "nosqli-3", "scanner-ua" ], "request_line": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1", "request_sample": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, def", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e52a5267fd7475536555b36f2cc5215355932dd2", "protocol_details": { "http_method": "GET", "http_path": "\/console\/login\/LoginForm.jsp", "request_line": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1", "http_user_agent": "python-requests\/2.33.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, def", "attack_vector": "weblogic probe \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/console\/login\/LoginForm.jsp", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 58, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 42 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "pat-0857", "pat-0601", "pat-0741" ], "tags_summary_labels_fr": [ "pat-0857", "pat-0601", "pat-0741" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/console\/login\/LoginForm.jsp", "request_line": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1", "http_user_agent": "python-requests\/2.33.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "weblogic probe \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/console\/login\/LoginForm.jsp", "evidence_snippet": "GET \/console\/login\/LoginForm.jsp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, def", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3", "anomaly:scanner-ua", "http_probe_console", "http_sensitive_path", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }
11/07/2026 13:26:00 UTC	TCP	7001 · HTTP	http	Désérialisation deser java attack · via HTTP:7001 · (tentative d'exploit) · → /wls-wsat/CoordinatorPortType	Élevée	Moyen · 53
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET /wls-wsat/CoordinatorPortType UA python-requests/2.33.0 Émulateur HTTP WAF 9 Recommandation Investiguer Tags 950468:nosqli-3 scanner-ua anomaly:scanner-ua http_probe_weblogic_wls Cible HTTP GET /wls-wsat/CoordinatorPortType TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /wls-wsat/CoordinatorPortType Service HTTP Pourquoi cette classification : Type « deser_java_attack » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 53 Confiance : Confiance 95 % — Motif catalogue confirmé · 2 tag(s) WAF Protocole émulé 1 Signaux pat-0602 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) WebLogic wls-wsat Ligne de requête `GET /wls-wsat/CoordinatorPortType HTTP/1.1` User-Agent python-requests/2.33.0 Règles WAF nosqli-3 scanner-ua Payload (extrait) GET /wls-wsat/CoordinatorPortType HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: python-requests/2.33.0 Accept-Encoding: gzip, de Requête brute (extrait) GET /wls-wsat/CoordinatorPortType HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: python-requests/2.33.0 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "ecded1ae9fe16f9a597cb6e9d6d5e503a1334577", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "99e47b274371fad76141ed1627f3bcdf29dce19a", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 174, "payload_entropy": 5.136258019025346, "port_category": "registered", "org": "ClearStack B.V.", "service": "http", "app_proto": "http", "asn": 199792, "country": "NL", "dst_port": 7001, "risk_waf": 44, "risk_classification": 87, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 6.3, "risk_breakdown": { "waf": 44, "classification": 87, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 53, "tag_count": 6, "anomaly_count": 1, "campaign_key": "9a13839e361d7a021b1792ac4f054c4cd3837a93", "event_fingerprint": "af8fe99e3af1262506b6c57904f48eff4e2bbd3c", "classification_reason": "Type \u00ab deser_java_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 82, "precision_signals": [ "pat-0602" ], "kb_rule_ids": [ "pat-0602" ], "matched_patterns": [ "pat-0602" ], "matched_pattern_names": [ "WebLogic wls-wsat" ], "pattern_ids": [ "pat-0602" ], "confidence_breakdown": { "waf": 44, "classification": 87, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 53 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 199792, "org": "ClearStack B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "03a667e9788f431ccea6ef111974e586", "payload_hash": "ab57b341fcf417e75c8bc890c1e8368f", "path_pattern_hash": "16111671401e187b64b702a8ecb56bdf" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 53 }, "payload_preview": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, de", "method": "GET", "path": "\/wls-wsat\/CoordinatorPortType", "user_agent": "python-requests\/2.33.0", "waf_tags": [ "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "nosqli-3", "scanner-ua" ], "request_line": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1", "request_sample": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, de", "evidence": { "method": "GET", "path": "\/wls-wsat\/CoordinatorPortType", "user_agent": "python-requests\/2.33.0", "waf_tags": [ "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "nosqli-3", "scanner-ua" ], "request_line": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1", "request_sample": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, de", "classification_reason": "Type \u00ab deser_java_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "rce_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "38b2a8d8727440eaa19a5f2f44c5c31a131f795f", "protocol_details": { "http_method": "GET", "http_path": "\/wls-wsat\/CoordinatorPortType", "request_line": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1", "http_user_agent": "python-requests\/2.33.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, de", "attack_vector": "deser java attack \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wls-wsat\/CoordinatorPortType", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab deser_java_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab deser_java_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 44, "classification": 87, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 53 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 53, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "pat-0602" ], "tags_summary_labels_fr": [ "pat-0602" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/wls-wsat\/CoordinatorPortType", "request_line": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1", "http_user_agent": "python-requests\/2.33.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "deser java attack \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wls-wsat\/CoordinatorPortType", "evidence_snippet": "GET \/wls-wsat\/CoordinatorPortType HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, de", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950468:nosqli-3", "anomaly:scanner-ua", "http_probe_weblogic_wls", "http_ua_suspicious", "net_web_probe", "scanner-ua" ], "behavior_alert_count": 1, "behavior_priority": 96 }
11/07/2026 13:26:00 UTC	TCP	7001 · HTTP	http	Désérialisation deser java attack · via HTTP:7001 · (tentative d'exploit) · → /_async/AsyncResponseService	Élevée	Moyen · 53
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET /_async/AsyncResponseService UA python-requests/2.33.0 Émulateur HTTP WAF 9 Recommandation Investiguer Tags 950468:nosqli-3 scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET /_async/AsyncResponseService TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /_async/AsyncResponseService Service HTTP Pourquoi cette classification : Type « deser_java_attack » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 53 Confiance : Confiance 95 % — Motif catalogue confirmé · 2 tag(s) WAF Protocole émulé 1 Signaux pat-0179 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CVE-2019-2725 WebLogic CVE-2019-2725 Ligne de requête `GET /_async/AsyncResponseService HTTP/1.1` User-Agent python-requests/2.33.0 Règles WAF nosqli-3 scanner-ua Payload (extrait) GET /_async/AsyncResponseService HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: python-requests/2.33.0 Accept-Encoding: gzip, def Requête brute (extrait) GET /_async/AsyncResponseService HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: python-requests/2.33.0 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "ecded1ae9fe16f9a597cb6e9d6d5e503a1334577", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "5f607796f47a9c4deebf8fbd05129012563f96fa", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 173, "payload_entropy": 5.119894578363547, "port_category": "registered", "org": "ClearStack B.V.", "service": "http", "app_proto": "http", "asn": 199792, "country": "NL", "dst_port": 7001, "risk_waf": 44, "risk_classification": 87, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 44, "classification": 87, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 53, "tag_count": 5, "anomaly_count": 1, "campaign_key": "a419f9b22cb076200ba2abb21428f0da50046c1f", "event_fingerprint": "b2624b0e4471fbbf800f6475da10222096755cc4", "classification_reason": "Type \u00ab deser_java_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 82, "precision_signals": [ "pat-0179" ], "kb_rule_ids": [ "pat-0179" ], "matched_patterns": [ "pat-0179" ], "matched_pattern_names": [ "CVE-2019-2725 WebLogic CVE-2019-2725" ], "pattern_ids": [ "pat-0179" ], "confidence_breakdown": { "waf": 44, "classification": 87, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 53 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 199792, "org": "ClearStack B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "03a667e9788f431ccea6ef111974e586", "payload_hash": "b57b0da73d3cd0097e438d8a7279fa24", "path_pattern_hash": "01bc2c025b7f327650e4a8ec8490febd" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 53 }, "payload_preview": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, def", "method": "GET", "path": "\/_async\/AsyncResponseService", "user_agent": "python-requests\/2.33.0", "waf_tags": [ "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "nosqli-3", "scanner-ua" ], "request_line": "GET \/_async\/AsyncResponseService HTTP\/1.1", "request_sample": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, def", "evidence": { "method": "GET", "path": "\/_async\/AsyncResponseService", "user_agent": "python-requests\/2.33.0", "waf_tags": [ "950468:nosqli-3", "scanner-ua" ], "waf_rule_names": [ "nosqli-3", "scanner-ua" ], "request_line": "GET \/_async\/AsyncResponseService HTTP\/1.1", "request_sample": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, def", "classification_reason": "Type \u00ab deser_java_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "rce_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "361ceedd1e563abe4b08df42cf0bdbef40f750a7", "protocol_details": { "http_method": "GET", "http_path": "\/_async\/AsyncResponseService", "request_line": "GET \/_async\/AsyncResponseService HTTP\/1.1", "http_user_agent": "python-requests\/2.33.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, def", "attack_vector": "deser java attack \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_async\/AsyncResponseService", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab deser_java_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab deser_java_attack \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 44, "classification": 87, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 53 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 53, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "pat-0179" ], "tags_summary_labels_fr": [ "pat-0179" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/_async\/AsyncResponseService", "request_line": "GET \/_async\/AsyncResponseService HTTP\/1.1", "http_user_agent": "python-requests\/2.33.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "deser java attack \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_async\/AsyncResponseService", "evidence_snippet": "GET \/_async\/AsyncResponseService HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: python-requests\/2.33.0\r\nAccept-Encoding: gzip, def", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950468:nosqli-3", "anomaly:scanner-ua", "http_ua_suspicious", "net_web_probe", "scanner-ua" ] }

45.82.56.216

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence