|
|
TCP |
161
|
http
|
Tentative d'exploit
|
Élevée
|
Moyen · 44
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
161
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.95 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:161
User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:161 User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.95 Safari/537.36 Accept: */* Accept-Encoding: deflate, gzip Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "29c97de30513463c4dccf92df08c6cb19afb147b",
"http_host_hash": "9f62ccb71aa3ccce80e025e43406f21cc5712877",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 266,
"payload_entropy": 5.53387656558055,
"port_category": "well_known",
"org": "Alibaba (US) Technology Co., Ltd.",
"service": "http",
"app_proto": "http",
"asn": 45102,
"country": "SG",
"dst_port": 161,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 44,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "688b2271fd242ba2e980fe4b06483c59a5c9dfe9",
"event_fingerprint": "d3a1c9353c28aa9b24808583788ff6d69014bfc5",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 45102,
"org": "Alibaba (US) Technology Co., Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "758b76b1b9b76d51311e3e27818eca09",
"payload_hash": "4bd8046c0fa5486bc96b3f4ef1603bd0",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 161,
"service": "http"
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:161\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/28.",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/28.0.1500.95 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:161\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/28.0.1500.95 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: deflate, gzip\r\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:161\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/28.",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/28.0.1500.95 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:161\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/28.0.1500.95 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: deflate, gzip\r\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:161\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/28.",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bce7aaf2c4ff259d990fed896f69e56515707813",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"behavior_alert_count": 1,
"behavior_priority": 96
}
|
|
|
TCP |
161
|
http
|
Sonde HTTP
|
Élevée
|
Faible · 25
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
6
Recommandation
Surveiller
Tags
950470:nosqli-3
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
161
Chemin / cible
/favicon.ico
Pourquoi cette classification : Sonde HTTP (tag nosqli-3) · confiance 94%
Confiance classification
94%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.95 Safari/537.36
Règles WAF
nosqli-3
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:161
User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko)
Requête brute (extrait)
GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:161 User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.95 Safari/537.36 Accept: */* Accept-Encoding: deflate, gzip
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "29c97de30513463c4dccf92df08c6cb19afb147b",
"http_host_hash": "9f62ccb71aa3ccce80e025e43406f21cc5712877",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 211,
"payload_entropy": 5.376475167200862,
"port_category": "well_known",
"org": "Alibaba (US) Technology Co., Ltd.",
"service": "http",
"app_proto": "http",
"asn": 45102,
"country": "SG",
"dst_port": 161,
"risk_waf": 32,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.3,
"risk_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 25,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "ad8151c262860f529f0fb75886bfbcb7f083d0d1",
"event_fingerprint": "e42b4b07c2b96f4ca58f995cc8e6765e2554d855",
"classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 94%",
"confidence": 0.94,
"classification_confidence": 0.94,
"precision_score": 102,
"precision_signals": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"risk_confidence_factor": 94,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 45102,
"org": "Alibaba (US) Technology Co., Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "758b76b1b9b76d51311e3e27818eca09",
"payload_hash": "ed0ca29f3236431fce9ef34127fb64f3",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 161,
"service": "http"
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:161\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko)",
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/28.0.1500.95 Safari\/537.36",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:161\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/28.0.1500.95 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: deflate, gzip\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:161\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko)",
"evidence": {
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/28.0.1500.95 Safari\/537.36",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:161\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/28.0.1500.95 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: deflate, gzip\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:161\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko)",
"classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 94%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "61671796fd4b7a66cf2481a44151949f49d19917",
"ban_policy": "advisory_monitor",
"tags_list": [
"950470:nosqli-3"
]
}
|
|
|
TCP |
161
|
—
|
Sonde port
|
Faible
|
Faible · 15
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
161
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 12,
"payload_entropy": 0,
"port_category": "well_known",
"org": "Alibaba (US) Technology Co., Ltd.",
"service": null,
"app_proto": null,
"asn": 45102,
"country": "SG",
"dst_port": 161,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 15,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "ed83a6ae63693eaebad1fce0f878071db24b33d5",
"event_fingerprint": "ba4239b1cffd8f2ae2a4e58d06bd4b922992c65b",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 45102,
"org": "Alibaba (US) Technology Co., Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "15ec7bf0b50732b49f8228e07d243653",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 161
},
"payload_preview": "\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"request_sample": "\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ca8233dd1ec904c91069332da464f3b96a97a3a6",
"ban_policy": "advisory_monitor",
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
161
|
—
|
Sonde port
|
Faible
|
Faible · 15
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
161
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
0>0]T� ��0 0 �A��c 0
Meta JSON brut
{
"bytes_in": 64,
"payload_entropy": 3.6427539413205468,
"port_category": "well_known",
"org": "Alibaba (US) Technology Co., Ltd.",
"service": null,
"app_proto": null,
"asn": 45102,
"country": "SG",
"dst_port": 161,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 15,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "ed83a6ae63693eaebad1fce0f878071db24b33d5",
"event_fingerprint": "ba4239b1cffd8f2ae2a4e58d06bd4b922992c65b",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 45102,
"org": "Alibaba (US) Technology Co., Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "647c5ba41deb8720ac72499939792486",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 161
},
"payload_preview": "0>\u0002\u0001\u00030\u0011\u0002\u0004\u0003]T\ufffd\u0002\u0003\u0000\ufffd\ufffd\u0004\u0001\u0004\u0002\u0001\u0003\u0004\u00100\u000e\u0004\u0000\u0002\u0001\u0000\u0002\u0001\u0000\u0004\u0000\u0004\u0000\u0004\u00000\u0014\u0004\u0000\u0004\u0000\ufffd\u000e\u0002\u0004A\ufffd\ufffdc\u0002\u0001\u0000\u0002\u0001\u00000\u0000",
"request_sample": "0>\u0002\u0001\u00030\u0011\u0002\u0004\u0003]T\ufffd\u0002\u0003\u0000\ufffd\ufffd\u0004\u0001\u0004\u0002\u0001\u0003\u0004\u00100\u000e\u0004\u0000\u0002\u0001\u0000\u0002\u0001\u0000\u0004\u0000\u0004\u0000\u0004\u00000\u0014\u0004\u0000\u0004\u0000\ufffd\u000e\u0002\u0004A\ufffd\ufffdc\u0002\u0001\u0000\u0002\u0001\u00000\u0000",
"payload_snippet": "0>\u0002\u0001\u00030\u0011\u0002\u0004\u0003]T\ufffd\u0002\u0003\u0000\ufffd\ufffd\u0004\u0001\u0004\u0002\u0001\u0003\u0004\u00100\u000e\u0004\u0000\u0002\u0001\u0000\u0002\u0001\u0000\u0004\u0000\u0004\u0000\u0004\u00000\u0014\u0004\u0000\u0004\u0000\ufffd\u000e\u0002\u0004A\ufffd\ufffdc\u0002\u0001\u0000\u0002\u0001\u00000\u0000",
"evidence": {
"request_sample": "0>\u0002\u0001\u00030\u0011\u0002\u0004\u0003]T\ufffd\u0002\u0003\u0000\ufffd\ufffd\u0004\u0001\u0004\u0002\u0001\u0003\u0004\u00100\u000e\u0004\u0000\u0002\u0001\u0000\u0002\u0001\u0000\u0004\u0000\u0004\u0000\u0004\u00000\u0014\u0004\u0000\u0004\u0000\ufffd\u000e\u0002\u0004A\ufffd\ufffdc\u0002\u0001\u0000\u0002\u0001\u00000\u0000",
"payload_snippet": "0>\u0002\u0001\u00030\u0011\u0002\u0004\u0003]T\ufffd\u0002\u0003\u0000\ufffd\ufffd\u0004\u0001\u0004\u0002\u0001\u0003\u0004\u00100\u000e\u0004\u0000\u0002\u0001\u0000\u0002\u0001\u0000\u0004\u0000\u0004\u0000\u0004\u00000\u0014\u0004\u0000\u0004\u0000\ufffd\u000e\u0002\u0004A\ufffd\ufffdc\u0002\u0001\u0000\u0002\u0001\u00000\u0000",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "29fffd1999d11b3d807bed0794e27e1c8c66df56",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9194
|
http
|
web attack
|
Élevée
|
Moyen · 48
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9194
Chemin / cible
/
Confiance classification
89%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2
Règles WAF
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:9194
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.57.2 (KHTML, like Gecko)
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c3b30c8e812628a5ac5ab3c4fcdc25028005f1a0",
"http_host_hash": "be8020e1a4c51badbe4e2860b2152c09f6b04c47",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 272,
"payload_entropy": 5.564629640238259,
"port_category": "registered",
"org": "Alibaba (US) Technology Co., Ltd.",
"service": "http",
"app_proto": "http",
"asn": 45102,
"country": "SG",
"dst_port": 9194,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 48,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cf60ea7a684eee25c08c2b924bb9ce0cee36ee32",
"event_fingerprint": "bcbe365d1af483724214522665a292fd9f9f5322",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 45102,
"org": "Alibaba (US) Technology Co., Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "d7bed5d08b4a0059a0b7ba8065763177",
"payload_hash": "bb98e300c682ee092caaf402d9ff7259",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 9194,
"service": "http"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"confidence": 0.89,
"classification_confidence": 0.89,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9194\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/534.57.2 (KHTML, like Gecko) ",
"event_signature": "d05e27750eb7f5de042a4326c2746bd54c0a496a",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"behavior_alert_count": 1,
"behavior_priority": 96
}
|
|
|
TCP |
9194
|
http
|
web attack
|
Élevée
|
Moyen · 43
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9194
Chemin / cible
/favicon.ico
Confiance classification
86%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2
Règles WAF
950326:rce-0
950470:nosqli-3
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:9194
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.57.2 (KHTML, l
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "c3b30c8e812628a5ac5ab3c4fcdc25028005f1a0",
"http_host_hash": "be8020e1a4c51badbe4e2860b2152c09f6b04c47",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 217,
"payload_entropy": 5.385909455230407,
"port_category": "registered",
"org": "Alibaba (US) Technology Co., Ltd.",
"service": "http",
"app_proto": "http",
"asn": 45102,
"country": "SG",
"dst_port": 9194,
"risk_waf": 60,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 43,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c1f0a805d3ee635308a4ad6447ce2b92d3a072ab",
"event_fingerprint": "b127b90ecf3ac2ee59044d83bae154ba99f19310",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 45102,
"org": "Alibaba (US) Technology Co., Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "d7bed5d08b4a0059a0b7ba8065763177",
"payload_hash": "d27c4191f4fae800a6d884cad36e62f1",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 9194,
"service": "http"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"confidence": 0.86,
"classification_confidence": 0.86,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9194\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/534.57.2 (KHTML, l",
"event_signature": "9ddff25d7703ff2f38bc0b89533584e910603c5e",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3"
]
}
|
|
|
TCP |
9194
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 21
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9194
Chemin / cible
—
Confiance classification
74%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
��9Z�mv�'K��{�#^�%x��#֯��1�f M� P��Q�M�ڃ��������5�{
9*d� 0�,�0̨̩�+�/�$�(�#�'�
�� � � � = < 5 / �
Meta JSON brut
{
"tls_ja3_hash": "410d9b65ff73443a9a062d12534d1ea7",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 517,
"payload_entropy": 4.01595652343507,
"port_category": "registered",
"org": "Alibaba (US) Technology Co., Ltd.",
"service": "tls",
"app_proto": "tls",
"asn": 45102,
"country": "SG",
"dst_port": 9194,
"risk_waf": 8,
"risk_classification": 30,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 30,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 21,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "fcef6865de3a6e0576b11fb4da7470af261f2b80",
"event_fingerprint": "f33c0e8fe71aca63616a65c4b565648549f69d01",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 45102,
"org": "Alibaba (US) Technology Co., Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "410d9b65ff73443a9a062d12534d1ea7",
"payload_hash": "977b80333edaf1c624615616d6234769",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 9194,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd9Z\ufffd\u0006mv\ufffd'K\ufffd\ufffd{\ufffd#^\ufffd\u001b%\u0007x\ufffd\ufffd#\u05af\ufffd\ufffd1\ufffdf M\ufffd\u001eP\ufffd\ufffdQ\ufffdM\ufffd\u0018\u0683\ufffd\ufffd\u0018\ufffd\ufffd\u0017\ufffd\ufffd\ufffd\ufffd5\ufffd{\r9*d\ufffd\u00000\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000",
"event_signature": "91a98c079c8b4a363d0e15a466ad897fa16d1621",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
9194
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 21
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9194
Chemin / cible
—
Confiance classification
74%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
n j�� [\�<# )u_\�7��[����O� �
�� � 5 / � 3
3t http/1.1
Meta JSON brut
{
"tls_ja3_hash": "370bfe45c50a2bbcec8e96b5c9efe8d3",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 2,
"tls_alpn": [
"http\/1.1"
],
"bytes_in": 115,
"payload_entropy": 4.936709398732837,
"port_category": "registered",
"org": "Alibaba (US) Technology Co., Ltd.",
"service": "tls",
"app_proto": "tls",
"asn": 45102,
"country": "SG",
"dst_port": 9194,
"risk_waf": 8,
"risk_classification": 30,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 30,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 21,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "fcef6865de3a6e0576b11fb4da7470af261f2b80",
"event_fingerprint": "12deba6100df2afa1748fe5e738c8c966a73b809",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 45102,
"org": "Alibaba (US) Technology Co., Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "370bfe45c50a2bbcec8e96b5c9efe8d3",
"payload_hash": "630875dd5bccf80d08742486971d52f9",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 9194,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0000n\u0001\u0000\u0000j\u0003\u0002\ufffd\ufffd\u0011\u001e\u0006[\u0007\u0010\\\ufffd<#\u001c)\u0012u_\\\ufffd7\ufffd\u0018\ufffd[\ufffd\ufffd\u0003\ufffd\ufffdO\ufffd\u0000\u0000\u000e\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u00005\u0000\/\u0000\ufffd\u0001\u0000\u00003\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u00183t\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000",
"event_signature": "4cc80723f1609c63cd35efad49150b0dde737698",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
9194
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 21
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9194
Chemin / cible
—
Confiance classification
74%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
���N�p��v
�P;V��
��U]s����azk �Bj�կl��{ɯ� ���w�T �!�fڱ� 0�,�0̨̩�+�/�$�(�#�'�
�� � � � = < 5 / �
Meta JSON brut
{
"tls_ja3_hash": "410d9b65ff73443a9a062d12534d1ea7",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"tls_alpn": [
"h2",
"http\/1.1"
],
"bytes_in": 517,
"payload_entropy": 4.041847865876787,
"port_category": "registered",
"org": "Alibaba (US) Technology Co., Ltd.",
"service": "tls",
"app_proto": "tls",
"asn": 45102,
"country": "SG",
"dst_port": 9194,
"risk_waf": 8,
"risk_classification": 30,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 30,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 21,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "fcef6865de3a6e0576b11fb4da7470af261f2b80",
"event_fingerprint": "f33c0e8fe71aca63616a65c4b565648549f69d01",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 45102,
"org": "Alibaba (US) Technology Co., Ltd.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "410d9b65ff73443a9a062d12534d1ea7",
"payload_hash": "ab7d5447124f671b5d5b2ef4905d48d6",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 9194,
"service": "tls"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdN\ufffdp\ufffd\ufffdv\r\ufffdP;V\ufffd\ufffd\r\ufffd\b\ufffdU]s\ufffd\ufffd\ufffd\ufffdazk \u0003\ufffdBj\ufffd\u056f\u0016l\ufffd\ufffd{\u026f\ufffd\u001d\u0016\ufffd\ufffd\ufffdw\ufffdT \ufffd!\ufffdf\u06b1\ufffd\u00000\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000",
"event_signature": "d554036a679f930d9c7e2bfd23770c28f0e358b5",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
5061
|
http
|
Sonde HTTP
|
Élevée
|
Moyen · 54
|
|
Étape
—
WAF
3
Recommandation
—
Tags
950734:sap-sapcontrol-path
http_missing_host
http_no_ua
Cible HTTP
OPTIONS
/
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
5061
Chemin / cible
/
Ligne de requête
OPTIONS / HTTP/1.1
User-Agent
—
Règles WAF
950734:sap-sapcontrol-path
Meta JSON brut
{
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 22,
"payload_entropy": 3.6069367321753214,
"port_category": "registered",
"org": "Alibaba US Technology Co., Ltd.",
"service": "http",
"app_proto": "http",
"asn": 45102,
"country": "SG",
"tag_count": 3,
"anomaly_count": 0,
"risk_score": 54,
"campaign_key": "286f6bc60d9ad567b1dcc64f0ff2c9b8348a0112",
"event_fingerprint": "7ff2c2cbe1761f6beb0e47c17843d16587a16076",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_missing_host",
"http_no_ua"
]
}
|
|
|
TCP |
5061
|
tls
|
Sonde TLS
|
Moyenne
|
Faible · 28
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
|
|
TCP |
5061
|
tls
|
Sonde TLS
|
Moyenne
|
Faible · 33
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
|
|
TCP |
5061
|
—
|
Sonde port
|
Faible
|
Faible · 0
|
|
Étape
—
WAF
—
Recommandation
—
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
|
|
TCP |
5061
|
tls
|
Sonde TLS
|
Moyenne
|
Faible · 28
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
|
|
TCP |
5061
|
tls
|
Sonde TLS
|
Moyenne
|
Faible · 28
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
|
|
TCP |
5061
|
tls
|
Sonde TLS
|
Moyenne
|
Faible · 33
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
|
|
TCP |
5061
|
http
|
web attack
|
Élevée
|
Critique · 100
|
|
Étape
—
WAF
16
Recommandation
—
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
5061
Chemin / cible
/
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Règles WAF
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "df352d7e1fe4a2c9e445f4d5a9564a20ec28f76f",
"http_host_hash": "005e322a3078983f8c88511133ba6778505d1be8",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 233,
"payload_entropy": 5.448658630500487,
"port_category": "registered",
"org": "Alibaba US Technology Co., Ltd.",
"service": "http",
"app_proto": "http",
"asn": 45102,
"country": "SG",
"tag_count": 3,
"anomaly_count": 0,
"risk_score": 100,
"campaign_key": "bdc652eac71e8786ae6ef8f4dd0262d2a485681a",
"event_fingerprint": "17a5eb8044ae571120c362c132c2a4d5eee30075",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
|
|
|
TCP |
1494
|
http
|
Sonde HTTP
|
Élevée
|
Moyen · 54
|
|
Étape
—
WAF
3
Recommandation
—
Tags
950734:sap-sapcontrol-path
http_missing_host
http_no_ua
Cible HTTP
OPTIONS
/
TLS SNI
—
Capteur
paris-1
|
Méthode
OPTIONS
Port
1494
Chemin / cible
/
Ligne de requête
OPTIONS / HTTP/1.1
User-Agent
—
Règles WAF
950734:sap-sapcontrol-path
Meta JSON brut
{
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 22,
"payload_entropy": 3.6069367321753214,
"port_category": "registered",
"org": "Alibaba US Technology Co., Ltd.",
"service": "http",
"app_proto": "http",
"asn": 45102,
"country": "SG",
"tag_count": 3,
"anomaly_count": 0,
"risk_score": 54,
"campaign_key": "869359c0349474bed0daf20a750521d69ed3007f",
"event_fingerprint": "8d94100659705e51fe16ec47950f91ee382faa16",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_missing_host",
"http_no_ua"
]
}
|
|
|
TCP |
1494
|
tls
|
Sonde TLS
|
Moyenne
|
Faible · 33
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
|
|
TCP |
1494
|
tls
|
Sonde TLS
|
Moyenne
|
Faible · 28
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
|
|
TCP |
1494
|
tls
|
Sonde TLS
|
Moyenne
|
Faible · 28
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
|
|
TCP |
1494
|
tls
|
Sonde TLS
|
Moyenne
|
Faible · 28
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
|
|
TCP |
1494
|
tls
|
Sonde TLS
|
Moyenne
|
Faible · 33
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
|
|
TCP |
1494
|
tls
|
Sonde TLS
|
Moyenne
|
Faible · 33
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
|
|
TCP |
1494
|
http
|
web attack
|
Élevée
|
Critique · 100
|
|
Étape
—
WAF
16
Recommandation
—
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
1494
Chemin / cible
/
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.122 Safari/537.36
Règles WAF
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f34c12d3b16e09b9a6fb4344adbf084080e298e3",
"http_host_hash": "2ada10e3fde28b58cb26e57df8ca56b05e39c293",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 281,
"payload_entropy": 5.565771448925586,
"port_category": "registered",
"org": "Alibaba US Technology Co., Ltd.",
"service": "http",
"app_proto": "http",
"asn": 45102,
"country": "SG",
"tag_count": 3,
"anomaly_count": 0,
"risk_score": 100,
"campaign_key": "c52361ec9222f8a6492a47441b842a0f0fd333f4",
"event_fingerprint": "a4dfc983b412005f5ae6e750d273f9a2503a112f",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
|
|
|
TCP |
1494
|
—
|
Sonde port
|
Faible
|
Faible · 0
|
|
Étape
—
WAF
—
Recommandation
—
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
|
|
TCP |
1494
|
tls
|
Sonde TLS
|
Moyenne
|
Faible · 28
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
|
|
TCP |
1494
|
tls
|
Sonde TLS
|
Moyenne
|
Faible · 28
|
|
Étape
—
WAF
—
Recommandation
—
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|