|
|
TCP |
5984 · COUCHDB
|
couchdb
|
Sonde CouchDB
couchdb probe · via COUCHDB:5984 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
Émulateur
COUCHDB
WAF
—
Recommandation
Surveiller
Tags
couchdb_emulated
couchdb_payload
net_couchdb_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5984
Chemin / cible
—
Service
COUCHDB
Payload
��i.��Ԓ a�vRt$��v:y��{�^�c| �N�A������nM<k�{��D��i×� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « Sonde CouchDB » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 4 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
��i.��Ԓ a�vRt$��v:y��{�^�c| �N�A������nM<k�{��D��i×� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
��i.��Ԓ a�vRt$��v:y��{�^�c| �N�A������nM<k�{��D��i×� $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ S�Nk
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534","emulator_response_len":286,"bytes_in":517,"payload_entropy":3.851284487311226,"port_category":"registered","org":"Amazon.com, Inc.","service":"couchdb","app_proto":"couchdb","asn":14618,"country":"US","dst_port":5984,"risk_waf":8,"risk_classification":54,"risk_behavior":0,"risk_geo":40,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.6,"risk_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":40,"protocol":30,"novelty":0},"risk_score":34,"tag_count":4,"anomaly_count":0,"campaign_key":"2a6ad211f73352e00bbd648921c2250031621d4a","event_fingerprint":"ff7d4ab9a5d149e36f724b4980f53d45ea707dff","classification_reason":"Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":40,"protocol":30,"novelty":0,"risk_score":34},"named_classification_skipped":false,"service_name":"couchdb","risk_confidence_factor":0,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"US","asn":14618,"org":"Amazon.com, Inc.","is_datacenter":true,"is_tor_hint":false},"…
|
|
|
TCP |
5984 · COUCHDB
|
couchdb
|
Sonde CouchDB
couchdb probe · via COUCHDB:5984 · (sonde / probe)
|
Élevée
|
Moyen · 49
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
Découverte
Accès
Protocole
Émulateur
COUCHDB
WAF
—
Recommandation
Surveiller
Tags
couchdb_emulated
couchdb_payload
couchdb_probe
couchdb_rest_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5984
Chemin / cible
—
Service
COUCHDB
Payload
GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/1
Pourquoi cette classification : Type « Sonde CouchDB » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 49
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Infra Couchdb Db
Upstream
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /_all_dbs HTTP/1.1
Host: 62.3.50.33:5984
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/1
Requête brute (extrait)
GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Accept: application/json Connection: keep-alive
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534","emulator_response_len":286,"bytes_in":236,"payload_entropy":5.35746502142702,"port_category":"registered","org":"Amazon.com, Inc.","service":"couchdb","app_proto":"couchdb","asn":14618,"country":"US","dst_port":5984,"risk_waf":8,"risk_classification":54,"risk_behavior":0,"risk_geo":40,"risk_protocol":40,"risk_novelty":25,"risk_boost":20,"risk_granularity":2.6,"risk_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":40,"protocol":40,"novelty":25},"risk_score":49,"tag_count":7,"anomaly_count":0,"campaign_key":"1a714389d6d9067ad71ffae1e1380faa8f150387","event_fingerprint":"ff7d4ab9a5d149e36f724b4980f53d45ea707dff","classification_reason":"Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%","confidence":0.95,"classification_confidence":0.95,"precision_score":87,"precision_signals":["INT-INFRA-couchdb-db","INT-upstream"],"kb_rule_ids":["INT-INFRA-couchdb-db","INT-upstream"],"confidence_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":40,"protocol":40,"novelty":25,"risk_score":49},"named_classification_skipped":false,"service_name":"couchdb","risk_confidence_factor":95,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country"…
|
|
|
TCP |
9200 · ELASTICSEARCH
|
elasticsearch
|
Sonde Elasticsearch
elasticsearch probe · via ELASTICSEARCH:9200 · (sonde / probe)
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
Sonde Elasticsearch (REST)
Émulateur
ELASTICSEARCH
WAF
—
Recommandation
Surveiller
Tags
elasticsearch_emulated
elasticsearch_tcp_probe
net_elasticsearch_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9200
Chemin / cible
—
Service
ELASTICSEARCH
Payload
� N���ԧA =m>2�igC�Tg� #H��u�� ���ڱR`�P�Jg����% +b{���'q_ $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « Sonde Elasticsearch » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 22
Confiance : Confiance 0 % — 4 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
�
N���ԧA =m>2�igC�Tg� #H��u�� ���ڱR`�P�Jg����%
+b{���'q_ $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
� N���ԧA =m>2�igC�Tg� #H��u�� ���ڱR`�P�Jg����% +b{���'q_ $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ ` ��
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c","emulator_response_len":172,"bytes_in":517,"payload_entropy":3.8503692598340584,"port_category":"registered","org":"Amazon.com, Inc.","service":"elasticsearch","app_proto":"elasticsearch","asn":14618,"country":"US","dst_port":9200,"risk_waf":8,"risk_classification":58,"risk_behavior":0,"risk_geo":40,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":5.2,"risk_breakdown":{"waf":8,"classification":58,"behavior":0,"geo":40,"protocol":30,"novelty":0},"risk_score":22,"tag_count":4,"anomaly_count":0,"campaign_key":"93abadea2248805c510cdc75076bd41245b4474e","event_fingerprint":"64ce65412bf1b81fa23464b76dd480979155e3d0","classification_reason":"Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":58,"behavior":0,"geo":40,"protocol":30,"novelty":0,"risk_score":22},"named_classification_skipped":false,"service_name":"elasticsearch","risk_confidence_factor":0,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"US","asn":14618,"org":"Amazon.com, Inc.","is_datacenter":tr…
|
|
|
TCP |
9200 · ELASTICSEARCH
|
elasticsearch
|
Sonde Elasticsearch
probe elastic · via ELASTICSEARCH:9200 · (sonde / probe) · → /_cat/indices
|
Élevée
|
Moyen · 61
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
GET /_cat/indices Requête Elasticsearch : /_cat/indices?format=json&h=index,docs.count UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
ELASTICSEARCH
WAF
30
Recommandation
Investiguer
Tags
950325:rce-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/_cat/indices
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9200
Chemin / cible
/_cat/indices
Pourquoi cette classification : Type « Sonde Elasticsearch » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 61
Confiance : Confiance 50 % — 5 tag(s) WAF
Protocole émulé
1
Signaux
Upstream
Waf Score
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
Ligne de requête
GET /_cat/indices?format=json&h=index,docs.count HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
elastic-cat
Payload (extrait)
GET /_cat/indices?format=json&h=index,docs.count HTTP/1.1
Host: 62.3.50.33:9200
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win6
Requête brute (extrait)
GET /_cat/indices?format=json&h=index,docs.count HTTP/1.1 Host: 62.3.50.33:9200 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Accept: applicati
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c","emulator_response_len":172,"http_header_count":5,"http_query_params":2,"http_path_depth":2,"http_path_ext":null,"http_ua_hash":"7b6f0c373feb98078719dc155349d959f98d35fe","http_host_hash":"d19a1b8472adabca1ee6e310101ca46b45ece34e","http_target_hash":"67225ad23ff20295ab44a5779024d1289f7349ce","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":291,"payload_entropy":5.42096844455287,"port_category":"registered","org":"Amazon.com, Inc.","service":"elasticsearch","app_proto":"elasticsearch","asn":14618,"country":"US","dst_port":9200,"risk_waf":100,"risk_classification":60,"risk_behavior":0,"risk_geo":40,"risk_protocol":50,"risk_novelty":25,"risk_boost":0,"risk_granularity":6.3,"risk_breakdown":{"waf":100,"classification":60,"behavior":0,"geo":40,"protocol":50,"novelty":25},"risk_score":61,"tag_count":7,"anomaly_count":0,"campaign_key":"b3baa74eb37ef30b3f5be7bc9b24eb028b6a8393","event_fingerprint":"7e851e2cec42d23bfa100bb0e446519a74e69329","classification_reason":"Type \u00ab probe_elastic \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence":0.5,"classification_confidence":0.5,"precision_score":55,"precision_signals"…
|