|
|
TCP |
8080 · HTTP
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
T1083
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8080
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.867970935302739,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8080,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "2e353a747b6bf388fd5efdb4fc787ed58b5cb70b",
"event_fingerprint": "6f2692bc71908c56e183d9937a18352a18a5c092",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci"
],
"pattern_ids": [
"pat-0245"
],
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7e667d0bfdb22e8b680d815527441fe6",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 50
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4bbdec9f187d16bb5e851ba5c2d656b4ef00f8e5",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploit_attempt",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
Sonde PostgreSQL
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �+�
�H_w�X�u��.̸uW��'������@B� ��<� [�'�]��w"��Dz!`6]$ .���[l �+�/�,�0̨̩� ��
� m # �
Requête brute (extrait)
� �+� �H_w�X�u��.̸uW��'������@B� ��<� [�'�]��w"��Dz!`6]$ .���[l �+�/�,�0̨̩� �� � m # � 2 +
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 211,
"payload_entropy": 5.359649269525387,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "https",
"app_proto": "https",
"asn": 206264,
"country": "SC",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "740e4829d0389ab0f54e92dbdfbac3d7",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "d6d0c0913b9a554768d7c94d80fa38f6",
"ja4": "04b8c2a54f4a5ec6389d78874a688522"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003+\ufffd\n\ufffdH_w\ufffdX\ufffd\u001au\ufffd\ufffd.\u0338u\u0002W\ufffd\ufffd'\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd@B\ufffd \ufffd\ufffd<\ufffd\u001f[\ufffd'\ufffd]\ufffd\ufffdw\"\ufffd\ufffdDz!`6]$\f\u0005.\ufffd\ufffd\ufffd[l\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003+\ufffd\n\ufffdH_w\ufffdX\ufffd\u001au\ufffd\ufffd.\u0338u\u0002W\ufffd\ufffd'\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd@B\ufffd \ufffd\ufffd<\ufffd\u001f[\ufffd'\ufffd]\ufffd\ufffdw\"\ufffd\ufffdDz!`6]$\f\u0005.\ufffd\ufffd\ufffd[l\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003+\ufffd\n\ufffdH_w\ufffdX\ufffd\u001au\ufffd\ufffd.\u0338u\u0002W\ufffd\ufffd'\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd@B\ufffd \ufffd\ufffd<\ufffd\u001f[\ufffd'\ufffd]\ufffd\ufffdw\"\ufffd\ufffdDz!`6]$\f\u0005.\ufffd\ufffd\ufffd[l\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003+\ufffd\n\ufffdH_w\ufffdX\ufffd\u001au\ufffd\ufffd.\u0338u\u0002W\ufffd\ufffd'\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd@B\ufffd \ufffd\ufffd<\ufffd\u001f[\ufffd'\ufffd]\ufffd\ufffdw\"\ufffd\ufffdDz!`6]$\f\u0005.\ufffd\ufffd\ufffd[l\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003+\ufffd\n\ufffdH_w\ufffdX\ufffd\u001au\ufffd\ufffd.\u0338u\u0002W\ufffd\ufffd'\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd@B\ufffd \ufffd\ufffd<\ufffd\u001f[\ufffd'\ufffd]\ufffd\ufffdw\"\ufffd\ufffdDz!`6]$\f\u0005.\ufffd\ufffd\ufffd[l\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "57659a3550d545f1ed77c65df2a18bbae7df87d0",
"tls_ja3_hash": "d6d0c0913b9a554768d7c94d80fa38f6",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172,11-35-65281-23-18-5-10-13-50-43,29-23-24-25,0",
"tls_ja4_hash": "04b8c2a54f4a5ec6389d78874a688522",
"tls_ja4": "t13d0110_be2ace872a35_cc710080a5f9",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
8888 · HTTP
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
T1083
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8888
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
HTTP alt 8888 probe
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8888
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "25a58e7d7f0ed40aadf0d51b038172ea9ccc8435",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.853492883002314,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8888,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "baef9552939334c8c9788435765acb8422844241",
"event_fingerprint": "5a49af6bb19f1dd917b679e38d2b698de98cf79a",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245",
"pat-0599"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci",
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0245",
"pat-0599"
],
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0ff0f89934bd0f2e0fe566fd43051cab",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8888,
"service": "http",
"service_name": "http",
"risk_score": 50
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fe69602b960352efd971f0a969dee53a0fb09d82",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploit_attempt",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
T1083
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8080
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.867970935302739,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8080,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "2e353a747b6bf388fd5efdb4fc787ed58b5cb70b",
"event_fingerprint": "6f2692bc71908c56e183d9937a18352a18a5c092",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci"
],
"pattern_ids": [
"pat-0245"
],
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7e667d0bfdb22e8b680d815527441fe6",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 50
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4bbdec9f187d16bb5e851ba5c2d656b4ef00f8e5",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploit_attempt",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
Sonde PostgreSQL
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �m@�%ke���,�[�P��<=9�v(V�� �)�� ���nb8��E�r� R
�[����A͟� �+�/�,�0̨̩� ��
� m # �
Requête brute (extrait)
� �m@�%ke���,�[�P��<=9�v(V�� �)�� ���nb8��E�r� R �[����A͟� �+�/�,�0̨̩� �� � m # � 2 +
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 211,
"payload_entropy": 5.2600691057211755,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "https",
"app_proto": "https",
"asn": 206264,
"country": "SC",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f42bfc4ae1e732ef7bc21558f68111af",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "d6d0c0913b9a554768d7c94d80fa38f6",
"ja4": "04b8c2a54f4a5ec6389d78874a688522"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003m\u000f\u0014@\ufffd\u0005%ke\ufffd\ufffd\ufffd,\ufffd[\ufffdP\ufffd\ufffd<=9\u0018\ufffd\bv(V\ufffd\ufffd \ufffd)\ufffd\ufffd\u001d\ufffd\ufffd\ufffdnb8\ufffd\ufffdE\ufffd\u0003r\ufffd\u0000R\n\u0004\ufffd[\ufffd\ufffd\ufffd\ufffdA\u035f\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003m\u000f\u0014@\ufffd\u0005%ke\ufffd\ufffd\ufffd,\ufffd[\ufffdP\ufffd\ufffd<=9\u0018\ufffd\bv(V\ufffd\ufffd \ufffd)\ufffd\ufffd\u001d\ufffd\ufffd\ufffdnb8\ufffd\ufffdE\ufffd\u0003r\ufffd\u0000R\n\u0004\ufffd[\ufffd\ufffd\ufffd\ufffdA\u035f\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003m\u000f\u0014@\ufffd\u0005%ke\ufffd\ufffd\ufffd,\ufffd[\ufffdP\ufffd\ufffd<=9\u0018\ufffd\bv(V\ufffd\ufffd \ufffd)\ufffd\ufffd\u001d\ufffd\ufffd\ufffdnb8\ufffd\ufffdE\ufffd\u0003r\ufffd\u0000R\n\u0004\ufffd[\ufffd\ufffd\ufffd\ufffdA\u035f\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003m\u000f\u0014@\ufffd\u0005%ke\ufffd\ufffd\ufffd,\ufffd[\ufffdP\ufffd\ufffd<=9\u0018\ufffd\bv(V\ufffd\ufffd \ufffd)\ufffd\ufffd\u001d\ufffd\ufffd\ufffdnb8\ufffd\ufffdE\ufffd\u0003r\ufffd\u0000R\n\u0004\ufffd[\ufffd\ufffd\ufffd\ufffdA\u035f\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003m\u000f\u0014@\ufffd\u0005%ke\ufffd\ufffd\ufffd,\ufffd[\ufffdP\ufffd\ufffd<=9\u0018\ufffd\bv(V\ufffd\ufffd \ufffd)\ufffd\ufffd\u001d\ufffd\ufffd\ufffdnb8\ufffd\ufffdE\ufffd\u0003r\ufffd\u0000R\n\u0004\ufffd[\ufffd\ufffd\ufffd\ufffdA\u035f\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4e0e2615543493ca95f39a06eaf49fe351ffc5d0",
"tls_ja3_hash": "d6d0c0913b9a554768d7c94d80fa38f6",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172,11-35-65281-23-18-5-10-13-50-43,29-23-24-25,0",
"tls_ja4_hash": "04b8c2a54f4a5ec6389d78874a688522",
"tls_ja4": "t13d0110_be2ace872a35_cc710080a5f9",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
8888 · HTTP
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
T1083
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8888
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
HTTP alt 8888 probe
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8888
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "25a58e7d7f0ed40aadf0d51b038172ea9ccc8435",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.853492883002314,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8888,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "baef9552939334c8c9788435765acb8422844241",
"event_fingerprint": "5a49af6bb19f1dd917b679e38d2b698de98cf79a",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245",
"pat-0599"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci",
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0245",
"pat-0599"
],
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0ff0f89934bd0f2e0fe566fd43051cab",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8888,
"service": "http",
"service_name": "http",
"risk_score": 50
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fe69602b960352efd971f0a969dee53a0fb09d82",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploit_attempt",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
T1083
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8080
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.867970935302739,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8080,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "2e353a747b6bf388fd5efdb4fc787ed58b5cb70b",
"event_fingerprint": "6f2692bc71908c56e183d9937a18352a18a5c092",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci"
],
"pattern_ids": [
"pat-0245"
],
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7e667d0bfdb22e8b680d815527441fe6",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 50
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4bbdec9f187d16bb5e851ba5c2d656b4ef00f8e5",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploit_attempt",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
Sonde PostgreSQL
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��U��Z $U���^�e(d"�����*4th�� �}�\ �l��9��Y�q��� \=\���� �+�/�,�0̨̩� ��
� m # �
Requête brute (extrait)
� ��U��Z $U���^�e(d"�����*4th�� �}�\ �l��9��Y�q��� \=\���� �+�/�,�0̨̩� �� � m # � 2 +
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 211,
"payload_entropy": 5.361376890267566,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "https",
"app_proto": "https",
"asn": 206264,
"country": "SC",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b59bd8eeb1a9dbe40d1f8866b15502d4",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "d6d0c0913b9a554768d7c94d80fa38f6",
"ja4": "04b8c2a54f4a5ec6389d78874a688522"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdU\ufffd\ufffdZ\u001c\u0013$U\ufffd\ufffd\ufffd^\ufffde(d\"\ufffd\ufffd\u0015\ufffd\ufffd\ufffd*4th\ufffd\ufffd\u000b \ufffd\u0015\u0016}\ufffd\u0017\\\u001e\ufffd\u0017l\ufffd\ufffd9\ufffd\ufffdY\u0013\ufffdq\ufffd\ufffd\ufffd\u000b\\=\\\ufffd\ufffd\ufffd\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdU\ufffd\ufffdZ\u001c\u0013$U\ufffd\ufffd\ufffd^\ufffde(d\"\ufffd\ufffd\u0015\ufffd\ufffd\ufffd*4th\ufffd\ufffd\u000b \ufffd\u0015\u0016}\ufffd\u0017\\\u001e\ufffd\u0017l\ufffd\ufffd9\ufffd\ufffdY\u0013\ufffdq\ufffd\ufffd\ufffd\u000b\\=\\\ufffd\ufffd\ufffd\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdU\ufffd\ufffdZ\u001c\u0013$U\ufffd\ufffd\ufffd^\ufffde(d\"\ufffd\ufffd\u0015\ufffd\ufffd\ufffd*4th\ufffd\ufffd\u000b \ufffd\u0015\u0016}\ufffd\u0017\\\u001e\ufffd\u0017l\ufffd\ufffd9\ufffd\ufffdY\u0013\ufffdq\ufffd\ufffd\ufffd\u000b\\=\\\ufffd\ufffd\ufffd\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdU\ufffd\ufffdZ\u001c\u0013$U\ufffd\ufffd\ufffd^\ufffde(d\"\ufffd\ufffd\u0015\ufffd\ufffd\ufffd*4th\ufffd\ufffd\u000b \ufffd\u0015\u0016}\ufffd\u0017\\\u001e\ufffd\u0017l\ufffd\ufffd9\ufffd\ufffdY\u0013\ufffdq\ufffd\ufffd\ufffd\u000b\\=\\\ufffd\ufffd\ufffd\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdU\ufffd\ufffdZ\u001c\u0013$U\ufffd\ufffd\ufffd^\ufffde(d\"\ufffd\ufffd\u0015\ufffd\ufffd\ufffd*4th\ufffd\ufffd\u000b \ufffd\u0015\u0016}\ufffd\u0017\\\u001e\ufffd\u0017l\ufffd\ufffd9\ufffd\ufffdY\u0013\ufffdq\ufffd\ufffd\ufffd\u000b\\=\\\ufffd\ufffd\ufffd\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9ff390dc3e9af343570a5281e28e834e5d9bddf9",
"tls_ja3_hash": "d6d0c0913b9a554768d7c94d80fa38f6",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172,11-35-65281-23-18-5-10-13-50-43,29-23-24-25,0",
"tls_ja4_hash": "04b8c2a54f4a5ec6389d78874a688522",
"tls_ja4": "t13d0110_be2ace872a35_cc710080a5f9",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
8888 · HTTP
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
T1083
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8888
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
HTTP alt 8888 probe
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8888
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "25a58e7d7f0ed40aadf0d51b038172ea9ccc8435",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.853492883002314,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8888,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "baef9552939334c8c9788435765acb8422844241",
"event_fingerprint": "5a49af6bb19f1dd917b679e38d2b698de98cf79a",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245",
"pat-0599"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci",
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0245",
"pat-0599"
],
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0ff0f89934bd0f2e0fe566fd43051cab",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8888,
"service": "http",
"service_name": "http",
"risk_score": 50
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fe69602b960352efd971f0a969dee53a0fb09d82",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploit_attempt",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
T1083
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8080
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.867970935302739,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8080,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "2e353a747b6bf388fd5efdb4fc787ed58b5cb70b",
"event_fingerprint": "6f2692bc71908c56e183d9937a18352a18a5c092",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci"
],
"pattern_ids": [
"pat-0245"
],
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7e667d0bfdb22e8b680d815527441fe6",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 50
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4bbdec9f187d16bb5e851ba5c2d656b4ef00f8e5",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploit_attempt",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
Sonde PostgreSQL
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �Q�� 2��Ce��3��_��E ����%&q�v �?o]�
�h����)F�? ���� �+�/�,�0̨̩� ��
� m # �
Requête brute (extrait)
� �Q�� 2��Ce��3��_��E ����%&q�v �?o]� �h����)F�? ���� �+�/�,�0̨̩� �� � m # � 2 +
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 211,
"payload_entropy": 5.250009159257774,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "https",
"app_proto": "https",
"asn": 206264,
"country": "SC",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "85e60b5feed4779e82b21abb22c37c7b",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "d6d0c0913b9a554768d7c94d80fa38f6",
"ja4": "04b8c2a54f4a5ec6389d78874a688522"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Q\u0019\ufffd\b\ufffd\u001c2\ufffd\b\ufffdCe\ufffd\ufffd3\ufffd\ufffd_\ufffd\ufffdE \u0016\ufffd\ufffd\ufffd\ufffd%&q\ufffdv \ufffd?\u001ao]\ufffd\r\u0011\u000e\ufffdh\ufffd\ufffd\ufffd\u0002\ufffd)F\ufffd\u0002?\u001f\ufffd\u0018\ufffd\ufffd\u0007\u0010\ufffd\u0013\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Q\u0019\ufffd\b\ufffd\u001c2\ufffd\b\ufffdCe\ufffd\ufffd3\ufffd\ufffd_\ufffd\ufffdE \u0016\ufffd\ufffd\ufffd\ufffd%&q\ufffdv \ufffd?\u001ao]\ufffd\r\u0011\u000e\ufffdh\ufffd\ufffd\ufffd\u0002\ufffd)F\ufffd\u0002?\u001f\ufffd\u0018\ufffd\ufffd\u0007\u0010\ufffd\u0013\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Q\u0019\ufffd\b\ufffd\u001c2\ufffd\b\ufffdCe\ufffd\ufffd3\ufffd\ufffd_\ufffd\ufffdE \u0016\ufffd\ufffd\ufffd\ufffd%&q\ufffdv \ufffd?\u001ao]\ufffd\r\u0011\u000e\ufffdh\ufffd\ufffd\ufffd\u0002\ufffd)F\ufffd\u0002?\u001f\ufffd\u0018\ufffd\ufffd\u0007\u0010\ufffd\u0013\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Q\u0019\ufffd\b\ufffd\u001c2\ufffd\b\ufffdCe\ufffd\ufffd3\ufffd\ufffd_\ufffd\ufffdE \u0016\ufffd\ufffd\ufffd\ufffd%&q\ufffdv \ufffd?\u001ao]\ufffd\r\u0011\u000e\ufffdh\ufffd\ufffd\ufffd\u0002\ufffd)F\ufffd\u0002?\u001f\ufffd\u0018\ufffd\ufffd\u0007\u0010\ufffd\u0013\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Q\u0019\ufffd\b\ufffd\u001c2\ufffd\b\ufffdCe\ufffd\ufffd3\ufffd\ufffd_\ufffd\ufffdE \u0016\ufffd\ufffd\ufffd\ufffd%&q\ufffdv \ufffd?\u001ao]\ufffd\r\u0011\u000e\ufffdh\ufffd\ufffd\ufffd\u0002\ufffd)F\ufffd\u0002?\u001f\ufffd\u0018\ufffd\ufffd\u0007\u0010\ufffd\u0013\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "432244205b87bfd3010d7f19bacd68ccaa75ae73",
"tls_ja3_hash": "d6d0c0913b9a554768d7c94d80fa38f6",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172,11-35-65281-23-18-5-10-13-50-43,29-23-24-25,0",
"tls_ja4_hash": "04b8c2a54f4a5ec6389d78874a688522",
"tls_ja4": "t13d0110_be2ace872a35_cc710080a5f9",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
8888 · HTTP
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
T1083
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8888
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
HTTP alt 8888 probe
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8888
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "25a58e7d7f0ed40aadf0d51b038172ea9ccc8435",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.853492883002314,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8888,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "baef9552939334c8c9788435765acb8422844241",
"event_fingerprint": "5a49af6bb19f1dd917b679e38d2b698de98cf79a",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245",
"pat-0599"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci",
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0245",
"pat-0599"
],
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0ff0f89934bd0f2e0fe566fd43051cab",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8888,
"service": "http",
"service_name": "http",
"risk_score": 50
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fe69602b960352efd971f0a969dee53a0fb09d82",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploit_attempt",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
T1083
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8080
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.867970935302739,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8080,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "2e353a747b6bf388fd5efdb4fc787ed58b5cb70b",
"event_fingerprint": "6f2692bc71908c56e183d9937a18352a18a5c092",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci"
],
"pattern_ids": [
"pat-0245"
],
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7e667d0bfdb22e8b680d815527441fe6",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 50
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4bbdec9f187d16bb5e851ba5c2d656b4ef00f8e5",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploit_attempt",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
Sonde PostgreSQL
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �o�V�)uOR�O�\��k�Fߺ�І�� �n�~ Z��:$ݤ�nl�U�jK�:��jo��@�� �+�/�,�0̨̩� ��
� m # �
Requête brute (extrait)
� �o�V�)uOR�O�\��k�Fߺ�І�� �n�~ Z��:$ݤ�nl�U�jK�:��jo��@�� �+�/�,�0̨̩� �� � m # � 2 +
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 211,
"payload_entropy": 5.327564721456655,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "https",
"app_proto": "https",
"asn": 206264,
"country": "SC",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a98d8b03a06e8351de37859f8ae8f810",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "d6d0c0913b9a554768d7c94d80fa38f6",
"ja4": "04b8c2a54f4a5ec6389d78874a688522"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003o\ufffdV\ufffd)uOR\ufffdO\ufffd\\\ufffd\ufffd\u001ak\ufffdF\u0011\u07fa\u0003\ufffd\u0406\ufffd\ufffd\u0000\ufffdn\ufffd~ Z\ufffd\ufffd:$\u0764\ufffdnl\ue616\ufffdU\ufffd\u0011jK\ufffd:\ufffd\ufffdjo\ufffd\ufffd@\ufffd\ufffd\u0002\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003o\ufffdV\ufffd)uOR\ufffdO\ufffd\\\ufffd\ufffd\u001ak\ufffdF\u0011\u07fa\u0003\ufffd\u0406\ufffd\ufffd\u0000\ufffdn\ufffd~ Z\ufffd\ufffd:$\u0764\ufffdnl\ue616\ufffdU\ufffd\u0011jK\ufffd:\ufffd\ufffdjo\ufffd\ufffd@\ufffd\ufffd\u0002\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003o\ufffdV\ufffd)uOR\ufffdO\ufffd\\\ufffd\ufffd\u001ak\ufffdF\u0011\u07fa\u0003\ufffd\u0406\ufffd\ufffd\u0000\ufffdn\ufffd~ Z\ufffd\ufffd:$\u0764\ufffdnl\ue616\ufffdU\ufffd\u0011jK\ufffd:\ufffd\ufffdjo\ufffd\ufffd@\ufffd\ufffd\u0002\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003o\ufffdV\ufffd)uOR\ufffdO\ufffd\\\ufffd\ufffd\u001ak\ufffdF\u0011\u07fa\u0003\ufffd\u0406\ufffd\ufffd\u0000\ufffdn\ufffd~ Z\ufffd\ufffd:$\u0764\ufffdnl\ue616\ufffdU\ufffd\u0011jK\ufffd:\ufffd\ufffdjo\ufffd\ufffd@\ufffd\ufffd\u0002\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003o\ufffdV\ufffd)uOR\ufffdO\ufffd\\\ufffd\ufffd\u001ak\ufffdF\u0011\u07fa\u0003\ufffd\u0406\ufffd\ufffd\u0000\ufffdn\ufffd~ Z\ufffd\ufffd:$\u0764\ufffdnl\ue616\ufffdU\ufffd\u0011jK\ufffd:\ufffd\ufffdjo\ufffd\ufffd@\ufffd\ufffd\u0002\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1fa3d69a67712908f826aad4db519867ee5ae978",
"tls_ja3_hash": "d6d0c0913b9a554768d7c94d80fa38f6",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172,11-35-65281-23-18-5-10-13-50-43,29-23-24-25,0",
"tls_ja4_hash": "04b8c2a54f4a5ec6389d78874a688522",
"tls_ja4": "t13d0110_be2ace872a35_cc710080a5f9",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
8888 · HTTP
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
T1083
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8888
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
HTTP alt 8888 probe
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8888
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "25a58e7d7f0ed40aadf0d51b038172ea9ccc8435",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.853492883002314,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8888,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "baef9552939334c8c9788435765acb8422844241",
"event_fingerprint": "5a49af6bb19f1dd917b679e38d2b698de98cf79a",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245",
"pat-0599"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci",
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0245",
"pat-0599"
],
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0ff0f89934bd0f2e0fe566fd43051cab",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8888,
"service": "http",
"service_name": "http"
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fe69602b960352efd971f0a969dee53a0fb09d82",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploit_attempt",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
T1083
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8080
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.867970935302739,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8080,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "2e353a747b6bf388fd5efdb4fc787ed58b5cb70b",
"event_fingerprint": "6f2692bc71908c56e183d9937a18352a18a5c092",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci"
],
"pattern_ids": [
"pat-0245"
],
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7e667d0bfdb22e8b680d815527441fe6",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http"
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4bbdec9f187d16bb5e851ba5c2d656b4ef00f8e5",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploit_attempt",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
Sonde PostgreSQL
|
Élevée
|
Faible · 15
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��H�iI����PZ�m�,��D�fA��r
�� ���v��ە�W�� ����l�� ohH�}Di �+�/�,�0̨̩� ��
� m # �
Requête brute (extrait)
� ��H�iI����PZ�m�,��D�fA��r �� ���v��ە�W�� ����l�� ohH�}Di �+�/�,�0̨̩� �� � m # � 2 +
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 211,
"payload_entropy": 5.331200246005676,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "https",
"app_proto": "https",
"asn": 206264,
"country": "SC",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 15,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 15
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "dc8b5a6b918c55a13a64bf687e4215a8",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "d6d0c0913b9a554768d7c94d80fa38f6",
"ja4": "04b8c2a54f4a5ec6389d78874a688522"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https"
},
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdH\ufffdiI\ufffd\ufffd\ufffd\u0004\ufffdPZ\ufffdm\ufffd,\u0014\ufffd\ufffdD\ufffdfA\ufffd\ufffdr\u0007\n\u0013\ufffd\ufffd \t\ufffd\ufffd\ufffdv\ufffd\ufffd\u06d5\ufffdW\ufffd\ufffd\u001d\ufffd\ufffd\ufffd\ufffdl\ufffd\ufffd\u0007\u0017\u001a\u001dohH\ufffd}Di\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdH\ufffdiI\ufffd\ufffd\ufffd\u0004\ufffdPZ\ufffdm\ufffd,\u0014\ufffd\ufffdD\ufffdfA\ufffd\ufffdr\u0007\n\u0013\ufffd\ufffd \t\ufffd\ufffd\ufffdv\ufffd\ufffd\u06d5\ufffdW\ufffd\ufffd\u001d\ufffd\ufffd\ufffd\ufffdl\ufffd\ufffd\u0007\u0017\u001a\u001dohH\ufffd}Di\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdH\ufffdiI\ufffd\ufffd\ufffd\u0004\ufffdPZ\ufffdm\ufffd,\u0014\ufffd\ufffdD\ufffdfA\ufffd\ufffdr\u0007\n\u0013\ufffd\ufffd \t\ufffd\ufffd\ufffdv\ufffd\ufffd\u06d5\ufffdW\ufffd\ufffd\u001d\ufffd\ufffd\ufffd\ufffdl\ufffd\ufffd\u0007\u0017\u001a\u001dohH\ufffd}Di\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdH\ufffdiI\ufffd\ufffd\ufffd\u0004\ufffdPZ\ufffdm\ufffd,\u0014\ufffd\ufffdD\ufffdfA\ufffd\ufffdr\u0007\n\u0013\ufffd\ufffd \t\ufffd\ufffd\ufffdv\ufffd\ufffd\u06d5\ufffdW\ufffd\ufffd\u001d\ufffd\ufffd\ufffd\ufffdl\ufffd\ufffd\u0007\u0017\u001a\u001dohH\ufffd}Di\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdH\ufffdiI\ufffd\ufffd\ufffd\u0004\ufffdPZ\ufffdm\ufffd,\u0014\ufffd\ufffdD\ufffdfA\ufffd\ufffdr\u0007\n\u0013\ufffd\ufffd \t\ufffd\ufffd\ufffdv\ufffd\ufffd\u06d5\ufffdW\ufffd\ufffd\u001d\ufffd\ufffd\ufffd\ufffdl\ufffd\ufffd\u0007\u0017\u001a\u001dohH\ufffd}Di\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "13c240b9ad26312c1222e05133f34833d44798cf",
"tls_ja3_hash": "d6d0c0913b9a554768d7c94d80fa38f6",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172,11-35-65281-23-18-5-10-13-50-43,29-23-24-25,0",
"tls_ja4_hash": "04b8c2a54f4a5ec6389d78874a688522",
"tls_ja4": "t13d0110_be2ace872a35_cc710080a5f9",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
8888 · HTTP
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
T1083
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8888
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
HTTP alt 8888 probe
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8888
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "25a58e7d7f0ed40aadf0d51b038172ea9ccc8435",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.853492883002314,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8888,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "baef9552939334c8c9788435765acb8422844241",
"event_fingerprint": "5a49af6bb19f1dd917b679e38d2b698de98cf79a",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245",
"pat-0599"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci",
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0245",
"pat-0599"
],
"confidence_breakdown": {
"classification": 1,
"kb_score": 127,
"rule_count": 3,
"payload_proof": false,
"pattern_proof": false
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0ff0f89934bd0f2e0fe566fd43051cab",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8888,
"service": "http",
"service_name": "http"
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fe69602b960352efd971f0a969dee53a0fb09d82",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8080
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8080
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.867970935302739,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8080,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "2e353a747b6bf388fd5efdb4fc787ed58b5cb70b",
"event_fingerprint": "6f2692bc71908c56e183d9937a18352a18a5c092",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7e667d0bfdb22e8b680d815527441fe6",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8080,
"service": "http"
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4bbdec9f187d16bb5e851ba5c2d656b4ef00f8e5",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8443
|
https
|
Sonde HTTP
|
Élevée
|
Faible · 14
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 34%
Confiance classification
34%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���kO�2v�ɱ��� �����J$���~Sz&: }��t�Z>/�~"�N����t`������� �+�/�,�0̨̩� ��
� m # �
Requête brute (extrait)
� ���kO�2v�ɱ��� �����J$���~Sz&: }��t�Z>/�~"�N����t`������� �+�/�,�0̨̩� �� � m # � 2 +
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 211,
"payload_entropy": 5.355399994870221,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "https",
"app_proto": "https",
"asn": 206264,
"country": "SC",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 14,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 34%",
"confidence": 0.34,
"classification_confidence": 0.34,
"precision_score": 40,
"precision_signals": [
"INT-single-port"
],
"kb_rule_ids": [
"INT-single-port"
],
"risk_confidence_factor": 34,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6303cea552cd0498e2e64484e58069be",
"path_pattern_hash": "4154520a4208b3f021f35a6cc1dd98ae"
},
"target_context": {
"dst_port": 8443,
"service": "https"
},
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdkO\u0012\ufffd2v\ufffd\u0271\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\ufffd\ufffd\ufffdJ$\ufffd\u0005\ufffd\ufffd~S\u000fz&: }\ufffd\ufffdt\ufffdZ>\u0002\/\ufffd~\"\u001b\ufffdN\ufffd\ufffd\u0006\ufffd\ufffdt`\ufffd\ufffd\u000e\ufffd\ufffd\ufffd\ufffd\u000f\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdkO\u0012\ufffd2v\ufffd\u0271\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\ufffd\ufffd\ufffdJ$\ufffd\u0005\ufffd\ufffd~S\u000fz&: }\ufffd\ufffdt\ufffdZ>\u0002\/\ufffd~\"\u001b\ufffdN\ufffd\ufffd\u0006\ufffd\ufffdt`\ufffd\ufffd\u000e\ufffd\ufffd\ufffd\ufffd\u000f\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdkO\u0012\ufffd2v\ufffd\u0271\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\ufffd\ufffd\ufffdJ$\ufffd\u0005\ufffd\ufffd~S\u000fz&: }\ufffd\ufffdt\ufffdZ>\u0002\/\ufffd~\"\u001b\ufffdN\ufffd\ufffd\u0006\ufffd\ufffdt`\ufffd\ufffd\u000e\ufffd\ufffd\ufffd\ufffd\u000f\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdkO\u0012\ufffd2v\ufffd\u0271\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\ufffd\ufffd\ufffdJ$\ufffd\u0005\ufffd\ufffd~S\u000fz&: }\ufffd\ufffdt\ufffdZ>\u0002\/\ufffd~\"\u001b\ufffdN\ufffd\ufffd\u0006\ufffd\ufffdt`\ufffd\ufffd\u000e\ufffd\ufffd\ufffd\ufffd\u000f\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdkO\u0012\ufffd2v\ufffd\u0271\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\ufffd\ufffd\ufffdJ$\ufffd\u0005\ufffd\ufffd~S\u000fz&: }\ufffd\ufffdt\ufffdZ>\u0002\/\ufffd~\"\u001b\ufffdN\ufffd\ufffd\u0006\ufffd\ufffdt`\ufffd\ufffd\u000e\ufffd\ufffd\ufffd\ufffd\u000f\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 34%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a0bcbcc0d6168f4a761b25a90f0dd61238a5ef03",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
8888
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8888
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8888
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "25a58e7d7f0ed40aadf0d51b038172ea9ccc8435",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.853492883002314,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8888,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "baef9552939334c8c9788435765acb8422844241",
"event_fingerprint": "5a49af6bb19f1dd917b679e38d2b698de98cf79a",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0ff0f89934bd0f2e0fe566fd43051cab",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8888,
"service": "http"
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fe69602b960352efd971f0a969dee53a0fb09d82",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8080
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8080
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.867970935302739,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8080,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "2e353a747b6bf388fd5efdb4fc787ed58b5cb70b",
"event_fingerprint": "6f2692bc71908c56e183d9937a18352a18a5c092",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci"
],
"pattern_ids": [
"pat-0245"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7e667d0bfdb22e8b680d815527441fe6",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8080,
"service": "http"
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4bbdec9f187d16bb5e851ba5c2d656b4ef00f8e5",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8443
|
https
|
Sonde PostgreSQL
|
Élevée
|
Faible · 15
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��"q�9-?�a�S�o�Sx�7��6�S�#Y im�M B�
GPTк�����*���ӽN����¦�S/P� �+�/�,�0̨̩� ��
� m # �
Requête brute (extrait)
� ��"q�9-?�a�S�o�Sx�7��6�S�#Y im�M B� GPTк�����*���ӽN����¦�S/P� �+�/�,�0̨̩� �� � m # � 2 +
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 211,
"payload_entropy": 5.360122565592257,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "https",
"app_proto": "https",
"asn": 206264,
"country": "SC",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 15,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "583dce00a0a009c4219afe5cb48cc261",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 8443,
"service": "https"
},
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\"q\ufffd9-?\ufffda\ufffdS\ufffdo\ufffdSx\ufffd7\ufffd\ufffd6\ufffdS\ufffd#Y\u001dim\ufffdM B\ufffd\rGPT\u043a\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffd\ufffd\ufffd\u04fdN\ufffd\ufffd\ufffd\u0017\ufffd\u00a6\ufffdS\/P\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\"q\ufffd9-?\ufffda\ufffdS\ufffdo\ufffdSx\ufffd7\ufffd\ufffd6\ufffdS\ufffd#Y\u001dim\ufffdM B\ufffd\rGPT\u043a\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffd\ufffd\ufffd\u04fdN\ufffd\ufffd\ufffd\u0017\ufffd\u00a6\ufffdS\/P\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\"q\ufffd9-?\ufffda\ufffdS\ufffdo\ufffdSx\ufffd7\ufffd\ufffd6\ufffdS\ufffd#Y\u001dim\ufffdM B\ufffd\rGPT\u043a\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffd\ufffd\ufffd\u04fdN\ufffd\ufffd\ufffd\u0017\ufffd\u00a6\ufffdS\/P\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\"q\ufffd9-?\ufffda\ufffdS\ufffdo\ufffdSx\ufffd7\ufffd\ufffd6\ufffdS\ufffd#Y\u001dim\ufffdM B\ufffd\rGPT\u043a\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffd\ufffd\ufffd\u04fdN\ufffd\ufffd\ufffd\u0017\ufffd\u00a6\ufffdS\/P\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\"q\ufffd9-?\ufffda\ufffdS\ufffdo\ufffdSx\ufffd7\ufffd\ufffd6\ufffdS\ufffd#Y\u001dim\ufffdM B\ufffd\rGPT\u043a\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffd\ufffd\ufffd\u04fdN\ufffd\ufffd\ufffd\u0017\ufffd\u00a6\ufffdS\/P\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "54359b4f84367bfc2f1ae490b19c217ab14eff31",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
8888
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8888
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
HTTP alt 8888 probe
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8888
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "25a58e7d7f0ed40aadf0d51b038172ea9ccc8435",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.853492883002314,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8888,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "baef9552939334c8c9788435765acb8422844241",
"event_fingerprint": "5a49af6bb19f1dd917b679e38d2b698de98cf79a",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245",
"pat-0599"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci",
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0245",
"pat-0599"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0ff0f89934bd0f2e0fe566fd43051cab",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8888,
"service": "http"
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fe69602b960352efd971f0a969dee53a0fb09d82",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8080
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8080
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.867970935302739,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8080,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "2e353a747b6bf388fd5efdb4fc787ed58b5cb70b",
"event_fingerprint": "6f2692bc71908c56e183d9937a18352a18a5c092",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci"
],
"pattern_ids": [
"pat-0245"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7e667d0bfdb22e8b680d815527441fe6",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8080,
"service": "http"
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4bbdec9f187d16bb5e851ba5c2d656b4ef00f8e5",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8443
|
https
|
Sonde PostgreSQL
|
Élevée
|
Faible · 15
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �;��7~ ���t����'{Z�z,�J�̂�� �ޮ��A�U�E����_�f�����P�Mb���� �+�/�,�0̨̩� ��
� m # �
Requête brute (extrait)
� �;��7~ ���t����'{Z�z,�J�̂�� �ޮ��A�U�E����_�f�����P�Mb���� �+�/�,�0̨̩� �� � m # � 2 +
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 211,
"payload_entropy": 5.356058599075992,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "https",
"app_proto": "https",
"asn": 206264,
"country": "SC",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 15,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "01be9c0e0df4869be07af3d85f17053d",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 8443,
"service": "https"
},
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003;\ufffd\ufffd\u00047\u0017~\u0004\u001c\ufffd\ufffd\ufffdt\u0007\u001b\ufffd\ufffd\ufffd\ufffd'{Z\ufffdz,\ufffdJ\ufffd\u0302\ufffd\ufffd \ufffd\u0017\u07ae\ufffd\ufffdA\ufffdU\ufffdE\ufffd\ufffd\ufffd\ufffd_\ufffdf\ufffd\ufffd\ufffd\u0006\ufffd\ufffdP\ufffdMb\ufffd\ufffd\ufffd\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003;\ufffd\ufffd\u00047\u0017~\u0004\u001c\ufffd\ufffd\ufffdt\u0007\u001b\ufffd\ufffd\ufffd\ufffd'{Z\ufffdz,\ufffdJ\ufffd\u0302\ufffd\ufffd \ufffd\u0017\u07ae\ufffd\ufffdA\ufffdU\ufffdE\ufffd\ufffd\ufffd\ufffd_\ufffdf\ufffd\ufffd\ufffd\u0006\ufffd\ufffdP\ufffdMb\ufffd\ufffd\ufffd\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003;\ufffd\ufffd\u00047\u0017~\u0004\u001c\ufffd\ufffd\ufffdt\u0007\u001b\ufffd\ufffd\ufffd\ufffd'{Z\ufffdz,\ufffdJ\ufffd\u0302\ufffd\ufffd \ufffd\u0017\u07ae\ufffd\ufffdA\ufffdU\ufffdE\ufffd\ufffd\ufffd\ufffd_\ufffdf\ufffd\ufffd\ufffd\u0006\ufffd\ufffdP\ufffdMb\ufffd\ufffd\ufffd\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003;\ufffd\ufffd\u00047\u0017~\u0004\u001c\ufffd\ufffd\ufffdt\u0007\u001b\ufffd\ufffd\ufffd\ufffd'{Z\ufffdz,\ufffdJ\ufffd\u0302\ufffd\ufffd \ufffd\u0017\u07ae\ufffd\ufffdA\ufffdU\ufffdE\ufffd\ufffd\ufffd\ufffd_\ufffdf\ufffd\ufffd\ufffd\u0006\ufffd\ufffdP\ufffdMb\ufffd\ufffd\ufffd\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003;\ufffd\ufffd\u00047\u0017~\u0004\u001c\ufffd\ufffd\ufffdt\u0007\u001b\ufffd\ufffd\ufffd\ufffd'{Z\ufffdz,\ufffdJ\ufffd\u0302\ufffd\ufffd \ufffd\u0017\u07ae\ufffd\ufffdA\ufffdU\ufffdE\ufffd\ufffd\ufffd\ufffd_\ufffdf\ufffd\ufffd\ufffd\u0006\ufffd\ufffdP\ufffdMb\ufffd\ufffd\ufffd\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ac1e6df6686c23312c334183e1c607d9259c68ed",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
8888
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8888
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
HTTP alt 8888 probe
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8888
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "25a58e7d7f0ed40aadf0d51b038172ea9ccc8435",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.853492883002314,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8888,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "baef9552939334c8c9788435765acb8422844241",
"event_fingerprint": "5a49af6bb19f1dd917b679e38d2b698de98cf79a",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245",
"pat-0599"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci",
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0245",
"pat-0599"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0ff0f89934bd0f2e0fe566fd43051cab",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8888,
"service": "http"
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fe69602b960352efd971f0a969dee53a0fb09d82",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8080
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8080
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.867970935302739,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8080,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "2e353a747b6bf388fd5efdb4fc787ed58b5cb70b",
"event_fingerprint": "6f2692bc71908c56e183d9937a18352a18a5c092",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci"
],
"pattern_ids": [
"pat-0245"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7e667d0bfdb22e8b680d815527441fe6",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8080,
"service": "http"
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4bbdec9f187d16bb5e851ba5c2d656b4ef00f8e5",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8443
|
https
|
Sonde PostgreSQL
|
Élevée
|
Faible · 15
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���%D±���S�}X���U�u�ûd/�lZ ��_�Bp��&=3i��� �t���� D*:k �+�/�,�0̨̩� ��
� m # �
Requête brute (extrait)
� ���%D±���S�}X���U�u�ûd/�lZ ��_�Bp��&=3i��� �t���� D*:k �+�/�,�0̨̩� �� � m # � 2 +
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 211,
"payload_entropy": 5.385563634569749,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "https",
"app_proto": "https",
"asn": 206264,
"country": "SC",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 15,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "93d7d57ccdcc2406c0a9efda45032eae",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 8443,
"service": "https"
},
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd%D\u00b1\ufffd\ufffd\ufffdS\ufffd}X\ufffd\ufffd\ufffdU\ufffdu\ufffd\u001a\u00fbd\/\ufffd\u0018l\u000fZ\u001f \u0014\ufffd\u0015\ufffd_\ufffdBp\ufffd\ufffd\u0005&=3i\ufffd\ufffd\u0012\ufffd\t\ufffdt\ufffd\u0006\ufffd\ufffd\ufffd\fD*:k\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd%D\u00b1\ufffd\ufffd\ufffdS\ufffd}X\ufffd\ufffd\ufffdU\ufffdu\ufffd\u001a\u00fbd\/\ufffd\u0018l\u000fZ\u001f \u0014\ufffd\u0015\ufffd_\ufffdBp\ufffd\ufffd\u0005&=3i\ufffd\ufffd\u0012\ufffd\t\ufffdt\ufffd\u0006\ufffd\ufffd\ufffd\fD*:k\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd%D\u00b1\ufffd\ufffd\ufffdS\ufffd}X\ufffd\ufffd\ufffdU\ufffdu\ufffd\u001a\u00fbd\/\ufffd\u0018l\u000fZ\u001f \u0014\ufffd\u0015\ufffd_\ufffdBp\ufffd\ufffd\u0005&=3i\ufffd\ufffd\u0012\ufffd\t\ufffdt\ufffd\u0006\ufffd\ufffd\ufffd\fD*:k\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd%D\u00b1\ufffd\ufffd\ufffdS\ufffd}X\ufffd\ufffd\ufffdU\ufffdu\ufffd\u001a\u00fbd\/\ufffd\u0018l\u000fZ\u001f \u0014\ufffd\u0015\ufffd_\ufffdBp\ufffd\ufffd\u0005&=3i\ufffd\ufffd\u0012\ufffd\t\ufffdt\ufffd\u0006\ufffd\ufffd\ufffd\fD*:k\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd%D\u00b1\ufffd\ufffd\ufffdS\ufffd}X\ufffd\ufffd\ufffdU\ufffdu\ufffd\u001a\u00fbd\/\ufffd\u0018l\u000fZ\u001f \u0014\ufffd\u0015\ufffd_\ufffdBp\ufffd\ufffd\u0005&=3i\ufffd\ufffd\u0012\ufffd\t\ufffdt\ufffd\u0006\ufffd\ufffd\ufffd\fD*:k\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "09d351f646e8126a94b6bc465fd5be5bc670626b",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
8888
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8888
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
HTTP alt 8888 probe
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8888
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "25a58e7d7f0ed40aadf0d51b038172ea9ccc8435",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.853492883002314,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8888,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "baef9552939334c8c9788435765acb8422844241",
"event_fingerprint": "5a49af6bb19f1dd917b679e38d2b698de98cf79a",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245",
"pat-0599"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci",
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0245",
"pat-0599"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0ff0f89934bd0f2e0fe566fd43051cab",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8888,
"service": "http"
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fe69602b960352efd971f0a969dee53a0fb09d82",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8080
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8080
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.867970935302739,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8080,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "2e353a747b6bf388fd5efdb4fc787ed58b5cb70b",
"event_fingerprint": "6f2692bc71908c56e183d9937a18352a18a5c092",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci"
],
"pattern_ids": [
"pat-0245"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7e667d0bfdb22e8b680d815527441fe6",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8080,
"service": "http"
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4bbdec9f187d16bb5e851ba5c2d656b4ef00f8e5",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8443
|
https
|
Sonde PostgreSQL
|
Élevée
|
Faible · 15
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��� 0�������#?ۂ� �=�A(�}��O ��0���xyTx�]֤���ns��,���6 �+�/�,�0̨̩� ��
� m # �
Requête brute (extrait)
� ��� 0�������#?ۂ� �=�A(�}��O ��0���xyTx�]֤���ns��,���6 �+�/�,�0̨̩� �� � m # � 2 +
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 211,
"payload_entropy": 5.32968394252712,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "https",
"app_proto": "https",
"asn": 206264,
"country": "SC",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 15,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5773b376015fea5ba48dcf98bbb65b64",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 8443,
"service": "https"
},
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\f\u00130\ufffd\ufffd\ufffd\ufffd\ufffd\u0011\ufffd\ufffd#?\u06c2\ufffd\f\u0006\ufffd=\u0013\ufffdA(\ufffd}\ufffd\ufffdO \ufffd\ufffd0\ufffd\u0012\u0007\ufffd\ufffdxyTx\u0001\ufffd]\u05a4\ufffd\u0013\u001a\ufffd\ufffdn\u001as\ufffd\ufffd,\ufffd\ufffd\ufffd6\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\f\u00130\ufffd\ufffd\ufffd\ufffd\ufffd\u0011\ufffd\ufffd#?\u06c2\ufffd\f\u0006\ufffd=\u0013\ufffdA(\ufffd}\ufffd\ufffdO \ufffd\ufffd0\ufffd\u0012\u0007\ufffd\ufffdxyTx\u0001\ufffd]\u05a4\ufffd\u0013\u001a\ufffd\ufffdn\u001as\ufffd\ufffd,\ufffd\ufffd\ufffd6\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\f\u00130\ufffd\ufffd\ufffd\ufffd\ufffd\u0011\ufffd\ufffd#?\u06c2\ufffd\f\u0006\ufffd=\u0013\ufffdA(\ufffd}\ufffd\ufffdO \ufffd\ufffd0\ufffd\u0012\u0007\ufffd\ufffdxyTx\u0001\ufffd]\u05a4\ufffd\u0013\u001a\ufffd\ufffdn\u001as\ufffd\ufffd,\ufffd\ufffd\ufffd6\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\f\u00130\ufffd\ufffd\ufffd\ufffd\ufffd\u0011\ufffd\ufffd#?\u06c2\ufffd\f\u0006\ufffd=\u0013\ufffdA(\ufffd}\ufffd\ufffdO \ufffd\ufffd0\ufffd\u0012\u0007\ufffd\ufffdxyTx\u0001\ufffd]\u05a4\ufffd\u0013\u001a\ufffd\ufffdn\u001as\ufffd\ufffd,\ufffd\ufffd\ufffd6\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\f\u00130\ufffd\ufffd\ufffd\ufffd\ufffd\u0011\ufffd\ufffd#?\u06c2\ufffd\f\u0006\ufffd=\u0013\ufffdA(\ufffd}\ufffd\ufffdO \ufffd\ufffd0\ufffd\u0012\u0007\ufffd\ufffdxyTx\u0001\ufffd]\u05a4\ufffd\u0013\u001a\ufffd\ufffdn\u001as\ufffd\ufffd,\ufffd\ufffd\ufffd6\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8b2e6681032b9c674bc208a3760776e77d87cba4",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
8888
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8888
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
HTTP alt 8888 probe
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8888
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "25a58e7d7f0ed40aadf0d51b038172ea9ccc8435",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.853492883002314,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8888,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "baef9552939334c8c9788435765acb8422844241",
"event_fingerprint": "5a49af6bb19f1dd917b679e38d2b698de98cf79a",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245",
"pat-0599"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci",
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0245",
"pat-0599"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0ff0f89934bd0f2e0fe566fd43051cab",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8888,
"service": "http"
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fe69602b960352efd971f0a969dee53a0fb09d82",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8080
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8080
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.867970935302739,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8080,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "2e353a747b6bf388fd5efdb4fc787ed58b5cb70b",
"event_fingerprint": "6f2692bc71908c56e183d9937a18352a18a5c092",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci"
],
"pattern_ids": [
"pat-0245"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7e667d0bfdb22e8b680d815527441fe6",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8080,
"service": "http"
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4bbdec9f187d16bb5e851ba5c2d656b4ef00f8e5",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8443
|
https
|
Sonde PostgreSQL
|
Élevée
|
Faible · 15
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��T���gn�F�a�g|�Z1%Pb:�LF �a lcF�^�y�Saw� �<D �xܜ���}����Y �+�/�,�0̨̩� ��
� m # �
Requête brute (extrait)
� ��T���gn�F�a�g|�Z1%Pb:�LF �a lcF�^�y�Saw� �<D �xܜ���}����Y �+�/�,�0̨̩� �� � m # � 2 +
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 211,
"payload_entropy": 5.362122764361218,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "https",
"app_proto": "https",
"asn": 206264,
"country": "SC",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 15,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d71991e22ab398583f15cfcba8d7d91c",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 8443,
"service": "https"
},
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdT\ufffd\ufffd\ufffdgn\ufffd\u0003F\ufffda\ufffdg|\ufffd\u0002Z1%Pb:\ufffdLF\u000b\u000f\ufffda lcF\ufffd^\ufffd\u0001y\ufffdSaw\ufffd\u000b\ufffd\u0010<D\u000b\ufffdx\u071c\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffdY\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdT\ufffd\ufffd\ufffdgn\ufffd\u0003F\ufffda\ufffdg|\ufffd\u0002Z1%Pb:\ufffdLF\u000b\u000f\ufffda lcF\ufffd^\ufffd\u0001y\ufffdSaw\ufffd\u000b\ufffd\u0010<D\u000b\ufffdx\u071c\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffdY\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdT\ufffd\ufffd\ufffdgn\ufffd\u0003F\ufffda\ufffdg|\ufffd\u0002Z1%Pb:\ufffdLF\u000b\u000f\ufffda lcF\ufffd^\ufffd\u0001y\ufffdSaw\ufffd\u000b\ufffd\u0010<D\u000b\ufffdx\u071c\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffdY\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdT\ufffd\ufffd\ufffdgn\ufffd\u0003F\ufffda\ufffdg|\ufffd\u0002Z1%Pb:\ufffdLF\u000b\u000f\ufffda lcF\ufffd^\ufffd\u0001y\ufffdSaw\ufffd\u000b\ufffd\u0010<D\u000b\ufffdx\u071c\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffdY\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdT\ufffd\ufffd\ufffdgn\ufffd\u0003F\ufffda\ufffdg|\ufffd\u0002Z1%Pb:\ufffdLF\u000b\u000f\ufffda lcF\ufffd^\ufffd\u0001y\ufffdSaw\ufffd\u000b\ufffd\u0010<D\u000b\ufffdx\u071c\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffdY\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8c6fc3e9ccc8340c32d2e7cb2988bfdbe5d9ccca",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
8888
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8888
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
HTTP alt 8888 probe
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8888
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "25a58e7d7f0ed40aadf0d51b038172ea9ccc8435",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.853492883002314,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8888,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "baef9552939334c8c9788435765acb8422844241",
"event_fingerprint": "5a49af6bb19f1dd917b679e38d2b698de98cf79a",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245",
"pat-0599"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci",
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0245",
"pat-0599"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0ff0f89934bd0f2e0fe566fd43051cab",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8888,
"service": "http"
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fe69602b960352efd971f0a969dee53a0fb09d82",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8080
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8080
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.867970935302739,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8080,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "2e353a747b6bf388fd5efdb4fc787ed58b5cb70b",
"event_fingerprint": "6f2692bc71908c56e183d9937a18352a18a5c092",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci"
],
"pattern_ids": [
"pat-0245"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7e667d0bfdb22e8b680d815527441fe6",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8080,
"service": "http"
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4bbdec9f187d16bb5e851ba5c2d656b4ef00f8e5",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8443
|
https
|
Sonde PostgreSQL
|
Élevée
|
Faible · 15
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �RH��%�z,[�b]����Em��ڌIH!�� 2 S��ο����+���������$�dX�C�� �+�/�,�0̨̩� ��
� m # �
Requête brute (extrait)
� �RH��%�z,[�b]����Em��ڌIH!�� 2 S��ο����+���������$�dX�C�� �+�/�,�0̨̩� �� � m # � 2 +
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 211,
"payload_entropy": 5.35105602503383,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "https",
"app_proto": "https",
"asn": 206264,
"country": "SC",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 15,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8e949ccc281477772398dd996511143a",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 8443,
"service": "https"
},
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003R\u001aH\ufffd\ufffd%\ufffdz,[\ufffdb]\ufffd\ufffd\ufffd\ufffdEm\u0011\ufffd\ufffd\u068c\u001aIH!\ufffd\ufffd\t2 S\u0004\ufffd\ufffd\u03bf\ufffd\ufffd\ufffd\u0004\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0003\ufffd\ufffd$\ufffdd\u0015X\ufffdC\ufffd\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003R\u001aH\ufffd\ufffd%\ufffdz,[\ufffdb]\ufffd\ufffd\ufffd\ufffdEm\u0011\ufffd\ufffd\u068c\u001aIH!\ufffd\ufffd\t2 S\u0004\ufffd\ufffd\u03bf\ufffd\ufffd\ufffd\u0004\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0003\ufffd\ufffd$\ufffdd\u0015X\ufffdC\ufffd\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003R\u001aH\ufffd\ufffd%\ufffdz,[\ufffdb]\ufffd\ufffd\ufffd\ufffdEm\u0011\ufffd\ufffd\u068c\u001aIH!\ufffd\ufffd\t2 S\u0004\ufffd\ufffd\u03bf\ufffd\ufffd\ufffd\u0004\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0003\ufffd\ufffd$\ufffdd\u0015X\ufffdC\ufffd\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003R\u001aH\ufffd\ufffd%\ufffdz,[\ufffdb]\ufffd\ufffd\ufffd\ufffdEm\u0011\ufffd\ufffd\u068c\u001aIH!\ufffd\ufffd\t2 S\u0004\ufffd\ufffd\u03bf\ufffd\ufffd\ufffd\u0004\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0003\ufffd\ufffd$\ufffdd\u0015X\ufffdC\ufffd\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003R\u001aH\ufffd\ufffd%\ufffdz,[\ufffdb]\ufffd\ufffd\ufffd\ufffdEm\u0011\ufffd\ufffd\u068c\u001aIH!\ufffd\ufffd\t2 S\u0004\ufffd\ufffd\u03bf\ufffd\ufffd\ufffd\u0004\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0003\ufffd\ufffd$\ufffdd\u0015X\ufffdC\ufffd\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "246d2f812b1b1c750649122a606b078ad73f939a",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
8888
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8888
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
HTTP alt 8888 probe
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8888
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "25a58e7d7f0ed40aadf0d51b038172ea9ccc8435",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.853492883002314,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8888,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "baef9552939334c8c9788435765acb8422844241",
"event_fingerprint": "5a49af6bb19f1dd917b679e38d2b698de98cf79a",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245",
"pat-0599"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci",
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0245",
"pat-0599"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0ff0f89934bd0f2e0fe566fd43051cab",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8888,
"service": "http"
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fe69602b960352efd971f0a969dee53a0fb09d82",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8080
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8080
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.867970935302739,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8080,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "2e353a747b6bf388fd5efdb4fc787ed58b5cb70b",
"event_fingerprint": "6f2692bc71908c56e183d9937a18352a18a5c092",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci"
],
"pattern_ids": [
"pat-0245"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7e667d0bfdb22e8b680d815527441fe6",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8080,
"service": "http"
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4bbdec9f187d16bb5e851ba5c2d656b4ef00f8e5",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8443
|
https
|
Sonde PostgreSQL
|
Élevée
|
Faible · 15
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �l��~s���u�P +��d��
w�� V�ʳ�C =�
ܱ3��l�(��f�R$���ɳ=з�� �+�/�,�0̨̩� ��
� m # �
Requête brute (extrait)
� �l��~s���u�P +��d�� w�� V�ʳ�C =� ܱ3��l�(��f�R$���ɳ=з�� �+�/�,�0̨̩� �� � m # � 2 +
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 211,
"payload_entropy": 5.273417670110726,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "https",
"app_proto": "https",
"asn": 206264,
"country": "SC",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 15,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4070d30c53d73eccdfa3377dfb05879f",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 8443,
"service": "https"
},
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003l\ufffd\ufffd~s\ufffd\ufffd\ufffdu\ufffdP\f+\ufffd\ufffd\u001ad\ufffd\ufffd\u0019\nw\ufffd\ufffd\u0004\u0000V\ufffd\u02b3\ufffdC =\ufffd\n\u07313\ufffd\ufffdl\ufffd(\u0001\b\ufffd\u0014\ufffdf\ufffdR\u001b$\ufffd\ufffd\ufffd\u0273=\u0011\u0437\ufffd\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003l\ufffd\ufffd~s\ufffd\ufffd\ufffdu\ufffdP\f+\ufffd\ufffd\u001ad\ufffd\ufffd\u0019\nw\ufffd\ufffd\u0004\u0000V\ufffd\u02b3\ufffdC =\ufffd\n\u07313\ufffd\ufffdl\ufffd(\u0001\b\ufffd\u0014\ufffdf\ufffdR\u001b$\ufffd\ufffd\ufffd\u0273=\u0011\u0437\ufffd\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003l\ufffd\ufffd~s\ufffd\ufffd\ufffdu\ufffdP\f+\ufffd\ufffd\u001ad\ufffd\ufffd\u0019\nw\ufffd\ufffd\u0004\u0000V\ufffd\u02b3\ufffdC =\ufffd\n\u07313\ufffd\ufffdl\ufffd(\u0001\b\ufffd\u0014\ufffdf\ufffdR\u001b$\ufffd\ufffd\ufffd\u0273=\u0011\u0437\ufffd\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003l\ufffd\ufffd~s\ufffd\ufffd\ufffdu\ufffdP\f+\ufffd\ufffd\u001ad\ufffd\ufffd\u0019\nw\ufffd\ufffd\u0004\u0000V\ufffd\u02b3\ufffdC =\ufffd\n\u07313\ufffd\ufffdl\ufffd(\u0001\b\ufffd\u0014\ufffdf\ufffdR\u001b$\ufffd\ufffd\ufffd\u0273=\u0011\u0437\ufffd\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003l\ufffd\ufffd~s\ufffd\ufffd\ufffdu\ufffdP\f+\ufffd\ufffd\u001ad\ufffd\ufffd\u0019\nw\ufffd\ufffd\u0004\u0000V\ufffd\u02b3\ufffdC =\ufffd\n\u07313\ufffd\ufffdl\ufffd(\u0001\b\ufffd\u0014\ufffdf\ufffdR\u001b$\ufffd\ufffd\ufffd\u0273=\u0011\u0437\ufffd\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "80d7ed454df78c6277f48784dbf3ec0071389766",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
8888
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8888
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
HTTP alt 8888 probe
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8888
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "25a58e7d7f0ed40aadf0d51b038172ea9ccc8435",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.853492883002314,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8888,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "baef9552939334c8c9788435765acb8422844241",
"event_fingerprint": "5a49af6bb19f1dd917b679e38d2b698de98cf79a",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245",
"pat-0599"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci",
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0245",
"pat-0599"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0ff0f89934bd0f2e0fe566fd43051cab",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8888,
"service": "http"
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fe69602b960352efd971f0a969dee53a0fb09d82",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8080
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8080
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.867970935302739,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8080,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "2e353a747b6bf388fd5efdb4fc787ed58b5cb70b",
"event_fingerprint": "6f2692bc71908c56e183d9937a18352a18a5c092",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci"
],
"pattern_ids": [
"pat-0245"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7e667d0bfdb22e8b680d815527441fe6",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8080,
"service": "http"
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4bbdec9f187d16bb5e851ba5c2d656b4ef00f8e5",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8443
|
https
|
Sonde PostgreSQL
|
Élevée
|
Faible · 15
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��A�k�ꮄ���M�� `�~YV��RSauGa ^ܿ��{��UIoW���o'EP}� ΜMf[���0 �+�/�,�0̨̩� ��
� m # �
Requête brute (extrait)
� ��A�k�ꮄ���M�� `�~YV��RSauGa ^ܿ��{��UIoW���o'EP}� ΜMf[���0 �+�/�,�0̨̩� �� � m # � 2 +
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 211,
"payload_entropy": 5.3871918805003824,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "https",
"app_proto": "https",
"asn": 206264,
"country": "SC",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 15,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2c5697640bc8fd75164738aac965d33f",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 8443,
"service": "https"
},
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000e\u001bA\ufffdk\u0019\ufffd\uab84\ufffd\ufffd\ufffdM\ufffd\ufffd\t`\ufffd~YV\ufffd\u0017\ufffdRSauGa ^\u073f\ufffd\ufffd{\ufffd\ufffdUIoW\ufffd\ufffd\ufffdo'EP}\ufffd\u0000\u039cMf[\ufffd\ufffd\ufffd0\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000e\u001bA\ufffdk\u0019\ufffd\uab84\ufffd\ufffd\ufffdM\ufffd\ufffd\t`\ufffd~YV\ufffd\u0017\ufffdRSauGa ^\u073f\ufffd\ufffd{\ufffd\ufffdUIoW\ufffd\ufffd\ufffdo'EP}\ufffd\u0000\u039cMf[\ufffd\ufffd\ufffd0\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000e\u001bA\ufffdk\u0019\ufffd\uab84\ufffd\ufffd\ufffdM\ufffd\ufffd\t`\ufffd~YV\ufffd\u0017\ufffdRSauGa ^\u073f\ufffd\ufffd{\ufffd\ufffdUIoW\ufffd\ufffd\ufffdo'EP}\ufffd\u0000\u039cMf[\ufffd\ufffd\ufffd0\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000e\u001bA\ufffdk\u0019\ufffd\uab84\ufffd\ufffd\ufffdM\ufffd\ufffd\t`\ufffd~YV\ufffd\u0017\ufffdRSauGa ^\u073f\ufffd\ufffd{\ufffd\ufffdUIoW\ufffd\ufffd\ufffdo'EP}\ufffd\u0000\u039cMf[\ufffd\ufffd\ufffd0\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000e\u001bA\ufffdk\u0019\ufffd\uab84\ufffd\ufffd\ufffdM\ufffd\ufffd\t`\ufffd~YV\ufffd\u0017\ufffdRSauGa ^\u073f\ufffd\ufffd{\ufffd\ufffdUIoW\ufffd\ufffd\ufffdo'EP}\ufffd\u0000\u039cMf[\ufffd\ufffd\ufffd0\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3bad244c35c2f78d8bb77b05d82dc9c7e6492f94",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
8888
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8888
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
HTTP alt 8888 probe
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8888
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "25a58e7d7f0ed40aadf0d51b038172ea9ccc8435",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.853492883002314,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8888,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "baef9552939334c8c9788435765acb8422844241",
"event_fingerprint": "5a49af6bb19f1dd917b679e38d2b698de98cf79a",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245",
"pat-0599"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci",
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0245",
"pat-0599"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0ff0f89934bd0f2e0fe566fd43051cab",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8888,
"service": "http"
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fe69602b960352efd971f0a969dee53a0fb09d82",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8080
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8080
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.867970935302739,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8080,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "2e353a747b6bf388fd5efdb4fc787ed58b5cb70b",
"event_fingerprint": "6f2692bc71908c56e183d9937a18352a18a5c092",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci"
],
"pattern_ids": [
"pat-0245"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7e667d0bfdb22e8b680d815527441fe6",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8080,
"service": "http"
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4bbdec9f187d16bb5e851ba5c2d656b4ef00f8e5",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8443
|
https
|
Sonde PostgreSQL
|
Élevée
|
Faible · 15
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����
/�z"��Yq��>{>�ZML^f�?' ���"c|��+z���`�!���� }�8�� �+�/�,�0̨̩� ��
� m # �
Requête brute (extrait)
� ���� /�z"��Yq��>{>�ZML^f�?' ���"c|��+z���`�!���� }�8�� �+�/�,�0̨̩� �� � m # � 2 +
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 211,
"payload_entropy": 5.300103018734769,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "https",
"app_proto": "https",
"asn": 206264,
"country": "SC",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 15,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9071c349581e80ee32387a6bb57cf66a",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 8443,
"service": "https"
},
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\n\u001f\u0001\/\ufffd\u001az\"\ufffd\ufffdYq\ufffd\ufffd>{>\ufffdZM\u0002\u0011\u0014L^f\ufffd?' \ufffd\ufffd\ufffd\"c\u0007|\ufffd\ufffd+z\ufffd\ufffd\ufffd`\ufffd\u001b!\ufffd\ufffd\ufffd\u001a\u000f\ufffd\u0004\u001f}\ufffd8\u0006\ufffd\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\n\u001f\u0001\/\ufffd\u001az\"\ufffd\ufffdYq\ufffd\ufffd>{>\ufffdZM\u0002\u0011\u0014L^f\ufffd?' \ufffd\ufffd\ufffd\"c\u0007|\ufffd\ufffd+z\ufffd\ufffd\ufffd`\ufffd\u001b!\ufffd\ufffd\ufffd\u001a\u000f\ufffd\u0004\u001f}\ufffd8\u0006\ufffd\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\n\u001f\u0001\/\ufffd\u001az\"\ufffd\ufffdYq\ufffd\ufffd>{>\ufffdZM\u0002\u0011\u0014L^f\ufffd?' \ufffd\ufffd\ufffd\"c\u0007|\ufffd\ufffd+z\ufffd\ufffd\ufffd`\ufffd\u001b!\ufffd\ufffd\ufffd\u001a\u000f\ufffd\u0004\u001f}\ufffd8\u0006\ufffd\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\n\u001f\u0001\/\ufffd\u001az\"\ufffd\ufffdYq\ufffd\ufffd>{>\ufffdZM\u0002\u0011\u0014L^f\ufffd?' \ufffd\ufffd\ufffd\"c\u0007|\ufffd\ufffd+z\ufffd\ufffd\ufffd`\ufffd\u001b!\ufffd\ufffd\ufffd\u001a\u000f\ufffd\u0004\u001f}\ufffd8\u0006\ufffd\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\n\u001f\u0001\/\ufffd\u001az\"\ufffd\ufffdYq\ufffd\ufffd>{>\ufffdZM\u0002\u0011\u0014L^f\ufffd?' \ufffd\ufffd\ufffd\"c\u0007|\ufffd\ufffd+z\ufffd\ufffd\ufffd`\ufffd\u001b!\ufffd\ufffd\ufffd\u001a\u000f\ufffd\u0004\u001f}\ufffd8\u0006\ufffd\ufffd\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bddd9c56e4275bd3fe046431dc50b997c4809d6b",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
8888
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8888
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
HTTP alt 8888 probe
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8888
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "25a58e7d7f0ed40aadf0d51b038172ea9ccc8435",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.853492883002314,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8888,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "baef9552939334c8c9788435765acb8422844241",
"event_fingerprint": "5a49af6bb19f1dd917b679e38d2b698de98cf79a",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245",
"pat-0599"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci",
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0245",
"pat-0599"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0ff0f89934bd0f2e0fe566fd43051cab",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8888,
"service": "http"
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fe69602b960352efd971f0a969dee53a0fb09d82",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8080
|
http
|
Sonde fichier configuration
|
Élevée
|
Moyen · 50
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/luci/;stok=/locale
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/cgi-bin/luci/;stok=/locale
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /cgi-bin/luci
Ligne de requête
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/luci/;stok=/locale HTTP/1.1
Host: 62.3.50.33:8080
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 86,
"payload_entropy": 4.867970935302739,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "http",
"app_proto": "http",
"asn": 206264,
"country": "SC",
"dst_port": 8080,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "2e353a747b6bf388fd5efdb4fc787ed58b5cb70b",
"event_fingerprint": "6f2692bc71908c56e183d9937a18352a18a5c092",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0245"
],
"matched_pattern_names": [
"Probe \/cgi-bin\/luci"
],
"pattern_ids": [
"pat-0245"
],
"classification_parent": "backup_file_scan",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7e667d0bfdb22e8b680d815527441fe6",
"path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc"
},
"target_context": {
"dst_port": 8080,
"service": "http"
},
"payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci\/;stok=\/locale",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4bbdec9f187d16bb5e851ba5c2d656b4ef00f8e5",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
|
|
|
TCP |
8443
|
https
|
Sonde PostgreSQL
|
Élevée
|
Faible · 15
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �U�C��E.�,w��̍��Px�]��xy��� � A� �\L yT8|��U`�^��% 蜇
�+�/�,�0̨̩� ��
� m # �
Requête brute (extrait)
� �U�C��E.�,w��̍��Px�]��xy��� � A� �\L yT8|��U`�^��% 蜇 �+�/�,�0̨̩� �� � m # � 2 +
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 211,
"payload_entropy": 5.343015264765543,
"port_category": "registered",
"org": "Amarutu Technology Ltd",
"service": "https",
"app_proto": "https",
"asn": 206264,
"country": "SC",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 15,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 206264,
"org": "Amarutu Technology Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5440f1bf75dd99d9c64de5e6d998a677",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 8443,
"service": "https"
},
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003U\ufffdC\ufffd\ufffdE.\u0018\u0017\ufffd,w\ufffd\ufffd\u030d\ufffd\ufffdPx\ufffd\u0014]\ufffd\ufffdxy\ufffd\ufffd\ufffd \ufffd\f\u0014\tA\ufffd\u001c\ufffd\u0005\\L\u001dyT8|\ufffd\ufffdU`\ufffd^\ufffd\ufffd%\u001f\u8707\u0015\r\u0010\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003U\ufffdC\ufffd\ufffdE.\u0018\u0017\ufffd,w\ufffd\ufffd\u030d\ufffd\ufffdPx\ufffd\u0014]\ufffd\ufffdxy\ufffd\ufffd\ufffd \ufffd\f\u0014\tA\ufffd\u001c\ufffd\u0005\\L\u001dyT8|\ufffd\ufffdU`\ufffd^\ufffd\ufffd%\u001f\u8707\u0015\r\u0010\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003U\ufffdC\ufffd\ufffdE.\u0018\u0017\ufffd,w\ufffd\ufffd\u030d\ufffd\ufffdPx\ufffd\u0014]\ufffd\ufffdxy\ufffd\ufffd\ufffd \ufffd\f\u0014\tA\ufffd\u001c\ufffd\u0005\\L\u001dyT8|\ufffd\ufffdU`\ufffd^\ufffd\ufffd%\u001f\u8707\u0015\r\u0010\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003U\ufffdC\ufffd\ufffdE.\u0018\u0017\ufffd,w\ufffd\ufffd\u030d\ufffd\ufffdPx\ufffd\u0014]\ufffd\ufffdxy\ufffd\ufffd\ufffd \ufffd\f\u0014\tA\ufffd\u001c\ufffd\u0005\\L\u001dyT8|\ufffd\ufffdU`\ufffd^\ufffd\ufffd%\u001f\u8707\u0015\r\u0010\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0003\u0002\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003U\ufffdC\ufffd\ufffdE.\u0018\u0017\ufffd,w\ufffd\ufffd\u030d\ufffd\ufffdPx\ufffd\u0014]\ufffd\ufffdxy\ufffd\ufffd\ufffd \ufffd\f\u0014\tA\ufffd\u001c\ufffd\u0005\\L\u001dyT8|\ufffd\ufffdU`\ufffd^\ufffd\ufffd%\u001f\u8707\u0015\r\u0010\u0000\u0014\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0001\u0000\u0000m\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6846541a68a36a0c8e0cb2167fcbf1b26a46ea4c",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"tls_clienthello"
]
}
|