13/07/2026 12:30:47 UTC
TCP
3000 · HTTP
Spray credentials
bruteforce credential spray · via HTTP:3000 · (sonde / probe) · → /api/v1/webhooks
Élevée
Élevé · 65
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1078
TA0007
TA0001
Protocole
POST /api/v1/webhooks UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
31
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
POST
/api/v1/webhooks
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3000
Chemin / cible
/api/v1/webhooks
Pourquoi cette classification : Type « bruteforce_credential_spray » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 5 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1078
Beh Cred Stuff
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 921130 duplicate CL
Probe /api/v1/
Ligne de requête
POST /api/v1/webhooks HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Règles WAF
lfi-14
rce-0
nosqli-3
k8s-api
Payload (extrait)
POST /api/v1/webhooks HTTP/1.1
Host: 62.3.50.33:3000
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, li
Requête brute (extrait)
POST /api/v1/webhooks HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Length: 65 Accept: application/json, */* Connection: close Content-Type: ap
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "07b3f636f85048d240c220c68060800feecba27d",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "2902c9ecd4f22c86290d2460b16bd5c07edeb113",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 339,
"payload_entropy": 5.494399756212201,
"port_category": "registered",
"org": "Joint Stock Company TransTeleCom",
"service": "http",
"app_proto": "http",
"asn": 20485,
"country": "RU",
"dst_port": 3000,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.8,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 65,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "ae24e16f407274926e36115df9d2d8737671e300",
"event_fingerprint": "e797eeb7b58603d5d8e0f9a03b90c40c4c408336",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 121,
"precision_signals": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"kb_rule_ids": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"matched_patterns": [
"pat-0842",
"pat-0212"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Probe \/api\/v1\/"
],
"pattern_ids": [
"pat-0842",
"pat-0212"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 65
},
"named_classification_skipped": false,
"classification_parent": "credential_stuffing",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 20485,
"org": "Joint Stock Company TransTeleCom",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c1397ca4c438ef7fc95e8a6f78f01a9b",
"payload_hash": "f07aa637d41dcb1209da93fd56971d52",
"path_pattern_hash": "c48e59bd33a1ef5e890acc98262cd8af"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "POST \/api\/v1\/webhooks HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, li",
"method": "POST",
"path": "\/api\/v1\/webhooks",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/v1\/webhooks HTTP\/1.1",
"request_sample": "POST \/api\/v1\/webhooks HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nContent-Length: 65\r\nAccept: application\/json, *\/*\r\nConnection: close\r\nContent-Type: ap",
"payload_snippet": "POST \/api\/v1\/webhooks HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, li",
"evidence": {
"method": "POST",
"path": "\/api\/v1\/webhooks",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/v1\/webhooks HTTP\/1.1",
"request_sample": "POST \/api\/v1\/webhooks HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nContent-Length: 65\r\nAccept: application\/json, *\/*\r\nConnection: close\r\nContent-Type: ap",
"payload_snippet": "POST \/api\/v1\/webhooks HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, li",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1078",
"T1110"
],
"mitre": "T1078",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e8777e5872774197fb28c74df068eb3bf9799f32",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/v1\/webhooks",
"request_line": "POST \/api\/v1\/webhooks HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/v1\/webhooks HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, li",
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:3000 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/api\/v1\/webhooks",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1078 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 65
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"tags_summary_labels_fr": [
"MITRE-T1078",
"Beh Cred Stuff"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1078",
"mitre_technique": "T1078",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/v1\/webhooks",
"request_line": "POST \/api\/v1\/webhooks HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:3000 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/api\/v1\/webhooks",
"evidence_snippet": "POST \/api\/v1\/webhooks HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, li",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api",
"http_api_abuse",
"http_api_route_probe",
"http_credential_body",
"http_email_harvest",
"http_k8s_probe",
"http_probe_api",
"http_webhook_abuse",
"net_web_probe"
]
}
13/07/2026 12:29:06 UTC
TCP
3000 · HTTP
Sonde fichier credential / clé
credential file probe · via HTTP:3000 · (tentative d'exploit) · → /api/token
Élevée
Élevé · 66
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/token UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950600:k8s-api
Cible HTTP
POST
/api/token
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3000
Chemin / cible
/api/token
Pourquoi cette classification : Type « credential_file_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 66
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0465
pat-0477
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred API token endpoint
Cred Generic token path
Ligne de requête
POST /api/token HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
k8s-api
Payload (extrait)
POST /api/token HTTP/1.1
Host: 62.3.50.33:3000
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gec
Requête brute (extrait)
POST /api/token HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Length: 65 Accept: application/json, */* Connection: close Content-Type: applicat
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "07b3f636f85048d240c220c68060800feecba27d",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "750f8662f1f83701afe444508cdccd3c15a31f4b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 333,
"payload_entropy": 5.463332792203764,
"port_category": "registered",
"org": "Joint Stock Company TransTeleCom",
"service": "http",
"app_proto": "http",
"asn": 20485,
"country": "RU",
"dst_port": 3000,
"risk_waf": 100,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.8,
"risk_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 66,
"tag_count": 9,
"anomaly_count": 0,
"campaign_key": "c5f29f153b085a22092f12b43c6df445c7d8e0e8",
"event_fingerprint": "31da01120294ecb2e2a8699faf0dff27d0b5ea91",
"classification_reason": "Type \u00ab credential_file_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 160,
"precision_signals": [
"pat-0465",
"pat-0477"
],
"kb_rule_ids": [
"pat-0465",
"pat-0477"
],
"matched_patterns": [
"pat-0842",
"pat-0465",
"pat-0477"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred API token endpoint",
"Cred Generic token path"
],
"pattern_ids": [
"pat-0842",
"pat-0465",
"pat-0477"
],
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 66
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 20485,
"org": "Joint Stock Company TransTeleCom",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c1397ca4c438ef7fc95e8a6f78f01a9b",
"payload_hash": "e50c0e41cad92268d508cb4d90691a2b",
"path_pattern_hash": "77ea7c71f06b78432dc28245604ec880"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 66
},
"payload_preview": "POST \/api\/token HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gec",
"method": "POST",
"path": "\/api\/token",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/token HTTP\/1.1",
"request_sample": "POST \/api\/token HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nContent-Length: 65\r\nAccept: application\/json, *\/*\r\nConnection: close\r\nContent-Type: applicat",
"payload_snippet": "POST \/api\/token HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gec",
"evidence": {
"method": "POST",
"path": "\/api\/token",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/token HTTP\/1.1",
"request_sample": "POST \/api\/token HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nContent-Length: 65\r\nAccept: application\/json, *\/*\r\nConnection: close\r\nContent-Type: applicat",
"payload_snippet": "POST \/api\/token HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gec",
"classification_reason": "Type \u00ab credential_file_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2d7fe1246125a96ad4c4e2a55660f1d83209f16d",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/token",
"request_line": "POST \/api\/token HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/token HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gec",
"attack_vector": "credential file probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/token",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab credential_file_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab credential_file_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 66
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 66,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"pat-0465",
"pat-0477"
],
"tags_summary_labels_fr": [
"pat-0465",
"pat-0477"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/token",
"request_line": "POST \/api\/token HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/token",
"evidence_snippet": "POST \/api\/token HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gec",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api",
"http_credential_body",
"http_email_harvest",
"http_oauth_probe",
"http_probe_api",
"net_web_probe"
]
}
13/07/2026 12:28:58 UTC
TCP
3000 · HTTP
Spray credentials
bruteforce credential spray · via HTTP:3000 · (sonde / probe) · → /api/v1/login
Élevée
Élevé · 65
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1078
TA0007
TA0001
Protocole
POST /api/v1/login UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
31
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
POST
/api/v1/login
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3000
Chemin / cible
/api/v1/login
Pourquoi cette classification : Type « bruteforce_credential_spray » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 5 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1078
Beh Cred Stuff
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 921130 duplicate CL
Probe /api/v1/
Ligne de requête
POST /api/v1/login HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Règles WAF
lfi-14
rce-0
nosqli-3
k8s-api
Payload (extrait)
POST /api/v1/login HTTP/1.1
Host: 62.3.50.33:3000
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like
Requête brute (extrait)
POST /api/v1/login HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Length: 65 Accept: application/json, */* Connection: close Content-Type: appli
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "07b3f636f85048d240c220c68060800feecba27d",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "3e05ad7b8717327d74e2bafa238587083bda3185",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 336,
"payload_entropy": 5.481563383239246,
"port_category": "registered",
"org": "Joint Stock Company TransTeleCom",
"service": "http",
"app_proto": "http",
"asn": 20485,
"country": "RU",
"dst_port": 3000,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.8,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 65,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "e15b6122cc60dbaaecbb81aed890a05e4e9d53c9",
"event_fingerprint": "7aa8c890c38db67f1398b49f8db47496e1d74aac",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 121,
"precision_signals": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"kb_rule_ids": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"matched_patterns": [
"pat-0842",
"pat-0212"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Probe \/api\/v1\/"
],
"pattern_ids": [
"pat-0842",
"pat-0212"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 65
},
"named_classification_skipped": false,
"classification_parent": "credential_stuffing",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 20485,
"org": "Joint Stock Company TransTeleCom",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c1397ca4c438ef7fc95e8a6f78f01a9b",
"payload_hash": "c4b5b848282bcbf25fd5cab4e5036dc2",
"path_pattern_hash": "4b646f89758dbdea785acb659af355ec"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "POST \/api\/v1\/login HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like ",
"method": "POST",
"path": "\/api\/v1\/login",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/v1\/login HTTP\/1.1",
"request_sample": "POST \/api\/v1\/login HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nContent-Length: 65\r\nAccept: application\/json, *\/*\r\nConnection: close\r\nContent-Type: appli",
"payload_snippet": "POST \/api\/v1\/login HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like",
"evidence": {
"method": "POST",
"path": "\/api\/v1\/login",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/v1\/login HTTP\/1.1",
"request_sample": "POST \/api\/v1\/login HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nContent-Length: 65\r\nAccept: application\/json, *\/*\r\nConnection: close\r\nContent-Type: appli",
"payload_snippet": "POST \/api\/v1\/login HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1078",
"T1110"
],
"mitre": "T1078",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7bbdb3ac7cff2b966e49e59573afc4e9d616e93c",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/v1\/login",
"request_line": "POST \/api\/v1\/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/v1\/login HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like",
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:3000 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/api\/v1\/login",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1078 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 65
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"tags_summary_labels_fr": [
"MITRE-T1078",
"Beh Cred Stuff"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1078",
"mitre_technique": "T1078",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/v1\/login",
"request_line": "POST \/api\/v1\/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:3000 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/api\/v1\/login",
"evidence_snippet": "POST \/api\/v1\/login HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api",
"http_api_abuse",
"http_api_route_probe",
"http_credential_body",
"http_email_harvest",
"http_k8s_probe",
"http_probe_api",
"net_web_probe"
]
}
13/07/2026 12:28:46 UTC
TCP
3000 · HTTP
Spray credentials
bruteforce credential spray · via HTTP:3000 · (sonde / probe) · → /auth/sign_in
Élevée
Moyen · 59
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1078
TA0007
TA0001
Protocole
POST /auth/sign_in UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_credential_body
Cible HTTP
POST
/auth/sign_in
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3000
Chemin / cible
/auth/sign_in
Pourquoi cette classification : Type « bruteforce_credential_spray » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1078
Beh Cred Stuff
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /auth/sign_in HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
POST /auth/sign_in HTTP/1.1
Host: 62.3.50.33:3000
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like
Requête brute (extrait)
POST /auth/sign_in HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Length: 65 Accept: application/json, */* Connection: close Content-Type: appli
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "07b3f636f85048d240c220c68060800feecba27d",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "e8bad341fc93800439ed3dd331ff3a70ac632725",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 336,
"payload_entropy": 5.483952616818165,
"port_category": "registered",
"org": "Joint Stock Company TransTeleCom",
"service": "http",
"app_proto": "http",
"asn": 20485,
"country": "RU",
"dst_port": 3000,
"risk_waf": 84,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 84,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 59,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "dd452137ca360f23fc951126642333274dcf7c16",
"event_fingerprint": "28b6ffd9a34d3706dda9675abf0e4a783da40af7",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 121,
"precision_signals": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"kb_rule_ids": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 84,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 59
},
"named_classification_skipped": false,
"classification_parent": "credential_stuffing",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 20485,
"org": "Joint Stock Company TransTeleCom",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c1397ca4c438ef7fc95e8a6f78f01a9b",
"payload_hash": "546f19c69533dac279fed49b3d110acd",
"path_pattern_hash": "c764a50599335e132fa02c75e189c5ae"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "POST \/auth\/sign_in HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like ",
"method": "POST",
"path": "\/auth\/sign_in",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/auth\/sign_in HTTP\/1.1",
"request_sample": "POST \/auth\/sign_in HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nContent-Length: 65\r\nAccept: application\/json, *\/*\r\nConnection: close\r\nContent-Type: appli",
"payload_snippet": "POST \/auth\/sign_in HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like",
"evidence": {
"method": "POST",
"path": "\/auth\/sign_in",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/auth\/sign_in HTTP\/1.1",
"request_sample": "POST \/auth\/sign_in HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nContent-Length: 65\r\nAccept: application\/json, *\/*\r\nConnection: close\r\nContent-Type: appli",
"payload_snippet": "POST \/auth\/sign_in HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1078",
"T1110"
],
"mitre": "T1078",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c9874a8dbaa5256a1c2e2dd15ab99fefbbb502e8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/auth\/sign_in",
"request_line": "POST \/auth\/sign_in HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/auth\/sign_in HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like",
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:3000 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/auth\/sign_in",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1078 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 59
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"tags_summary_labels_fr": [
"MITRE-T1078",
"Beh Cred Stuff"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1078",
"mitre_technique": "T1078",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/auth\/sign_in",
"request_line": "POST \/auth\/sign_in HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:3000 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/auth\/sign_in",
"evidence_snippet": "POST \/auth\/sign_in HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_credential_body",
"http_email_harvest",
"net_web_probe"
]
}
12/07/2026 05:42:14 UTC
TCP
8000 · SAP ICM
Sonde HTTP smuggling
http smuggling probe · via SAP ICM:8000 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SAP-ICM
WAF
—
Recommandation
Investiguer
Tags
mozi_pattern
net_sap_web_probe
sap_icm_emulated
sap_icm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8000
Chemin / cible
—
Service
SAP ICM
Payload
POST /template HTTP/1.1 Host: 62.3.50.33:8000 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Geck
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /template HTTP/1.1
Host: 62.3.50.33:8000
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Geck
Requête brute (extrait)
POST /template HTTP/1.1 Host: 62.3.50.33:8000 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Length: 243 Accept: */* Connection: close Content-Type: application/x-www-form-url
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c",
"emulator_response_len": 141,
"bytes_in": 510,
"payload_entropy": 5.243735712029541,
"port_category": "registered",
"org": "Joint Stock Company TransTeleCom",
"service": "sap-icm",
"app_proto": "sap-icm",
"asn": 20485,
"country": "RU",
"dst_port": 8000,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 38,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 15
},
"risk_score": 52,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "b14f2cee1c4c6242f3f3bd5a0c201a85b58e6943",
"event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "sap-icm",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 20485,
"org": "Joint Stock Company TransTeleCom",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4a4566ee39508d170e4cdfbb5d0ae0a0",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 8000,
"service": "sap-icm",
"service_name": "sap-icm",
"risk_score": 52
},
"payload_preview": "POST \/template HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Geck",
"request_sample": "POST \/template HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nContent-Length: 243\r\nAccept: *\/*\r\nConnection: close\r\nContent-Type: application\/x-www-form-url",
"payload_snippet": "POST \/template HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Geck",
"evidence": {
"request_sample": "POST \/template HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nContent-Length: 243\r\nAccept: *\/*\r\nConnection: close\r\nContent-Type: application\/x-www-form-url",
"payload_snippet": "POST \/template HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Geck",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f63ccafd6f787f3c6786d3ad73a975b2a4ce07a8",
"protocol_details": {
"payload_preview": "POST \/template HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Geck",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"evidence_snippet": "POST \/template HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Geck",
"attack_vector": "http smuggling probe \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via SAP ICM",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "sap-icm",
"service_label_fr": "SAP ICM",
"dst_port": 8000,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-icm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/template HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Geck",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"attack_vector": "http smuggling probe \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/template HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Geck",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_icm",
"service_banner": "honeypot-sap-icm",
"service_os": "linux",
"dst_port": "8000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"mozi_pattern",
"net_sap_web_probe",
"sap_icm_emulated",
"sap_icm_payload"
]
}
12/07/2026 05:42:14 UTC
TCP
8000 · SAP ICM
Sonde SAP ICM HTTP
Sonde SAP ICM / WebDynpro · via SAP ICM:8000 · (sonde / probe)
Élevée
Faible · 34
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SAP-ICM
WAF
—
Recommandation
Surveiller
Tags
mozi_pattern
net_sap_web_probe
sap_icm_emulated
sap_icm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8000
Chemin / cible
—
Service
SAP ICM
Payload
GET /api?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&
Pourquoi cette classification : Type « sap_web_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 4 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&
Requête brute (extrait)
GET /api?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&message=%7B%7B7%2A7%7D%7D&text=%7B%7B7%2A7%7D%7D&content=%7B%7B7%2A7%7D%7D&subject=%7B%7B7%2A7%7D%7D&input=%7B%7B7%2A7%7D%7D&val
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c",
"emulator_response_len": 141,
"bytes_in": 554,
"payload_entropy": 4.921088981862464,
"port_category": "registered",
"org": "Joint Stock Company TransTeleCom",
"service": "sap-icm",
"app_proto": "sap-icm",
"asn": 20485,
"country": "RU",
"dst_port": 8000,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 38,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 15
},
"risk_score": 34,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "b14f2cee1c4c6242f3f3bd5a0c201a85b58e6943",
"event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a",
"classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 15,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "sap-icm",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 20485,
"org": "Joint Stock Company TransTeleCom",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "97293b2c98e2bfa05ec5da71527de29c",
"path_pattern_hash": "2dea5f3383fd8694e14eaf8b920fd9fc"
},
"target_context": {
"dst_port": 8000,
"service": "sap-icm",
"service_name": "sap-icm",
"risk_score": 34
},
"payload_preview": "GET \/api?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&",
"request_sample": "GET \/api?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&message=%7B%7B7%2A7%7D%7D&text=%7B%7B7%2A7%7D%7D&content=%7B%7B7%2A7%7D%7D&subject=%7B%7B7%2A7%7D%7D&input=%7B%7B7%2A7%7D%7D&val",
"payload_snippet": "GET \/api?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&",
"evidence": {
"request_sample": "GET \/api?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&message=%7B%7B7%2A7%7D%7D&text=%7B%7B7%2A7%7D%7D&content=%7B%7B7%2A7%7D%7D&subject=%7B%7B7%2A7%7D%7D&input=%7B%7B7%2A7%7D%7D&val",
"payload_snippet": "GET \/api?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&",
"classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"sap_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2d3914bd10cc285eb6fae2cbb4f0461812a3a4b3",
"protocol_details": {
"payload_preview": "GET \/api?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"evidence_snippet": "GET \/api?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&",
"attack_vector": "Sonde SAP ICM \/ WebDynpro \u00b7 via SAP ICM:8000 \u00b7 (sonde \/ probe)",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 15,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "sap-icm",
"service_label_fr": "SAP ICM",
"dst_port": 8000,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-icm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"attack_vector": "Sonde SAP ICM \/ WebDynpro \u00b7 via SAP ICM:8000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/api?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_icm",
"service_banner": "honeypot-sap-icm",
"service_os": "linux",
"dst_port": "8000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"mozi_pattern",
"net_sap_web_probe",
"sap_icm_emulated",
"sap_icm_payload"
]
}
12/07/2026 05:42:04 UTC
TCP
8000 · SAP ICM
Sonde SAP ICM HTTP
Sonde SAP ICM / WebDynpro · via SAP ICM:8000 · (sonde / probe)
Élevée
Faible · 34
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SAP-ICM
WAF
—
Recommandation
Surveiller
Tags
mozi_pattern
net_sap_web_probe
sap_icm_emulated
sap_icm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8000
Chemin / cible
—
Service
SAP ICM
Payload
GET /preview?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D
Pourquoi cette classification : Type « sap_web_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 4 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /preview?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D
Requête brute (extrait)
GET /preview?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&message=%7B%7B7%2A7%7D%7D&text=%7B%7B7%2A7%7D%7D&content=%7B%7B7%2A7%7D%7D&subject=%7B%7B7%2A7%7D%7D&input=%7B%7B7%2A7%7D%7D
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c",
"emulator_response_len": 141,
"bytes_in": 558,
"payload_entropy": 4.937577250201157,
"port_category": "registered",
"org": "Joint Stock Company TransTeleCom",
"service": "sap-icm",
"app_proto": "sap-icm",
"asn": 20485,
"country": "RU",
"dst_port": 8000,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 38,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 15
},
"risk_score": 34,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "b14f2cee1c4c6242f3f3bd5a0c201a85b58e6943",
"event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a",
"classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 15,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "sap-icm",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 20485,
"org": "Joint Stock Company TransTeleCom",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "80312b4a41712d208562bb98be354931",
"path_pattern_hash": "2dea5f3383fd8694e14eaf8b920fd9fc"
},
"target_context": {
"dst_port": 8000,
"service": "sap-icm",
"service_name": "sap-icm",
"risk_score": 34
},
"payload_preview": "GET \/preview?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D",
"request_sample": "GET \/preview?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&message=%7B%7B7%2A7%7D%7D&text=%7B%7B7%2A7%7D%7D&content=%7B%7B7%2A7%7D%7D&subject=%7B%7B7%2A7%7D%7D&input=%7B%7B7%2A7%7D%7D",
"payload_snippet": "GET \/preview?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D",
"evidence": {
"request_sample": "GET \/preview?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&message=%7B%7B7%2A7%7D%7D&text=%7B%7B7%2A7%7D%7D&content=%7B%7B7%2A7%7D%7D&subject=%7B%7B7%2A7%7D%7D&input=%7B%7B7%2A7%7D%7D",
"payload_snippet": "GET \/preview?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D",
"classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"sap_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c676cc9fff27e30a274ea60686e67b687f05df7b",
"protocol_details": {
"payload_preview": "GET \/preview?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"evidence_snippet": "GET \/preview?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D",
"attack_vector": "Sonde SAP ICM \/ WebDynpro \u00b7 via SAP ICM:8000 \u00b7 (sonde \/ probe)",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 15,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "sap-icm",
"service_label_fr": "SAP ICM",
"dst_port": 8000,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-icm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/preview?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"attack_vector": "Sonde SAP ICM \/ WebDynpro \u00b7 via SAP ICM:8000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/preview?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_icm",
"service_banner": "honeypot-sap-icm",
"service_os": "linux",
"dst_port": "8000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"mozi_pattern",
"net_sap_web_probe",
"sap_icm_emulated",
"sap_icm_payload"
]
}
12/07/2026 05:42:03 UTC
TCP
8000 · SAP ICM
Sonde HTTP smuggling
http smuggling probe · via SAP ICM:8000 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SAP-ICM
WAF
—
Recommandation
Investiguer
Tags
mozi_pattern
net_sap_web_probe
sap_icm_emulated
sap_icm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8000
Chemin / cible
—
Service
SAP ICM
Payload
POST /render HTTP/1.1 Host: 62.3.50.33:8000 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko)
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /render HTTP/1.1
Host: 62.3.50.33:8000
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko)
Requête brute (extrait)
POST /render HTTP/1.1 Host: 62.3.50.33:8000 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Length: 243 Accept: */* Connection: close Content-Type: application/x-www-form-urlen
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c",
"emulator_response_len": 141,
"bytes_in": 508,
"payload_entropy": 5.2470353710039,
"port_category": "registered",
"org": "Joint Stock Company TransTeleCom",
"service": "sap-icm",
"app_proto": "sap-icm",
"asn": 20485,
"country": "RU",
"dst_port": 8000,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 38,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 15
},
"risk_score": 52,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "b14f2cee1c4c6242f3f3bd5a0c201a85b58e6943",
"event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "sap-icm",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 20485,
"org": "Joint Stock Company TransTeleCom",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "70de94a444bd123ea57d9c9313eaf7fa",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 8000,
"service": "sap-icm",
"service_name": "sap-icm",
"risk_score": 52
},
"payload_preview": "POST \/render HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko)",
"request_sample": "POST \/render HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nContent-Length: 243\r\nAccept: *\/*\r\nConnection: close\r\nContent-Type: application\/x-www-form-urlen",
"payload_snippet": "POST \/render HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko)",
"evidence": {
"request_sample": "POST \/render HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nContent-Length: 243\r\nAccept: *\/*\r\nConnection: close\r\nContent-Type: application\/x-www-form-urlen",
"payload_snippet": "POST \/render HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko)",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fc409031790bd11d914a4cdd5b3ed5f394372a07",
"protocol_details": {
"payload_preview": "POST \/render HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko)",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"evidence_snippet": "POST \/render HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko)",
"attack_vector": "http smuggling probe \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via SAP ICM",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "sap-icm",
"service_label_fr": "SAP ICM",
"dst_port": 8000,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-icm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/render HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko)",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"attack_vector": "http smuggling probe \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/render HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko)",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_icm",
"service_banner": "honeypot-sap-icm",
"service_os": "linux",
"dst_port": "8000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"mozi_pattern",
"net_sap_web_probe",
"sap_icm_emulated",
"sap_icm_payload"
]
}
12/07/2026 05:41:57 UTC
TCP
8000 · SAP ICM
Sonde SAP ICM HTTP
Sonde SAP ICM / WebDynpro · via SAP ICM:8000 · (sonde / probe)
Élevée
Faible · 34
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SAP-ICM
WAF
—
Recommandation
Surveiller
Tags
mozi_pattern
net_sap_web_probe
sap_icm_emulated
sap_icm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8000
Chemin / cible
—
Service
SAP ICM
Payload
GET /search?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%
Pourquoi cette classification : Type « sap_web_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 4 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /search?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%
Requête brute (extrait)
GET /search?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&message=%7B%7B7%2A7%7D%7D&text=%7B%7B7%2A7%7D%7D&content=%7B%7B7%2A7%7D%7D&subject=%7B%7B7%2A7%7D%7D&input=%7B%7B7%2A7%7D%7D&
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c",
"emulator_response_len": 141,
"bytes_in": 557,
"payload_entropy": 4.927796737963947,
"port_category": "registered",
"org": "Joint Stock Company TransTeleCom",
"service": "sap-icm",
"app_proto": "sap-icm",
"asn": 20485,
"country": "RU",
"dst_port": 8000,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 38,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 15
},
"risk_score": 34,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "b14f2cee1c4c6242f3f3bd5a0c201a85b58e6943",
"event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a",
"classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 15,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "sap-icm",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 20485,
"org": "Joint Stock Company TransTeleCom",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "71acc7f45d33e5d0970bcab74d992e8e",
"path_pattern_hash": "2dea5f3383fd8694e14eaf8b920fd9fc"
},
"target_context": {
"dst_port": 8000,
"service": "sap-icm",
"service_name": "sap-icm",
"risk_score": 34
},
"payload_preview": "GET \/search?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%",
"request_sample": "GET \/search?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&message=%7B%7B7%2A7%7D%7D&text=%7B%7B7%2A7%7D%7D&content=%7B%7B7%2A7%7D%7D&subject=%7B%7B7%2A7%7D%7D&input=%7B%7B7%2A7%7D%7D&",
"payload_snippet": "GET \/search?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%",
"evidence": {
"request_sample": "GET \/search?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&message=%7B%7B7%2A7%7D%7D&text=%7B%7B7%2A7%7D%7D&content=%7B%7B7%2A7%7D%7D&subject=%7B%7B7%2A7%7D%7D&input=%7B%7B7%2A7%7D%7D&",
"payload_snippet": "GET \/search?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%",
"classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"sap_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "421d3add4db9b46b8957efe91c208fbebe40e294",
"protocol_details": {
"payload_preview": "GET \/search?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"evidence_snippet": "GET \/search?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%",
"attack_vector": "Sonde SAP ICM \/ WebDynpro \u00b7 via SAP ICM:8000 \u00b7 (sonde \/ probe)",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 15,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "sap-icm",
"service_label_fr": "SAP ICM",
"dst_port": 8000,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-icm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/search?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"attack_vector": "Sonde SAP ICM \/ WebDynpro \u00b7 via SAP ICM:8000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/search?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_icm",
"service_banner": "honeypot-sap-icm",
"service_os": "linux",
"dst_port": "8000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"mozi_pattern",
"net_sap_web_probe",
"sap_icm_emulated",
"sap_icm_payload"
]
}
12/07/2026 05:41:57 UTC
TCP
8000 · SAP ICM
Sonde HTTP smuggling
http smuggling probe · via SAP ICM:8000 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SAP-ICM
WAF
—
Recommandation
Investiguer
Tags
mozi_pattern
net_sap_web_probe
sap_icm_emulated
sap_icm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8000
Chemin / cible
—
Service
SAP ICM
Payload
POST /search HTTP/1.1 Host: 62.3.50.33:8000 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko)
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /search HTTP/1.1
Host: 62.3.50.33:8000
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko)
Requête brute (extrait)
POST /search HTTP/1.1 Host: 62.3.50.33:8000 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Length: 243 Accept: */* Connection: close Content-Type: application/x-www-form-urlen
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c",
"emulator_response_len": 141,
"bytes_in": 508,
"payload_entropy": 5.250730263208893,
"port_category": "registered",
"org": "Joint Stock Company TransTeleCom",
"service": "sap-icm",
"app_proto": "sap-icm",
"asn": 20485,
"country": "RU",
"dst_port": 8000,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 38,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 15
},
"risk_score": 52,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "b14f2cee1c4c6242f3f3bd5a0c201a85b58e6943",
"event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "sap-icm",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 20485,
"org": "Joint Stock Company TransTeleCom",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "05da3bebfe247ab37b3847622404bd1b",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 8000,
"service": "sap-icm",
"service_name": "sap-icm",
"risk_score": 52
},
"payload_preview": "POST \/search HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko)",
"request_sample": "POST \/search HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nContent-Length: 243\r\nAccept: *\/*\r\nConnection: close\r\nContent-Type: application\/x-www-form-urlen",
"payload_snippet": "POST \/search HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko)",
"evidence": {
"request_sample": "POST \/search HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nContent-Length: 243\r\nAccept: *\/*\r\nConnection: close\r\nContent-Type: application\/x-www-form-urlen",
"payload_snippet": "POST \/search HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko)",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8d8bfae130b18827ebe873f397e4559c40a47c8f",
"protocol_details": {
"payload_preview": "POST \/search HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko)",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"evidence_snippet": "POST \/search HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko)",
"attack_vector": "http smuggling probe \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via SAP ICM",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "sap-icm",
"service_label_fr": "SAP ICM",
"dst_port": 8000,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-icm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/search HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko)",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"attack_vector": "http smuggling probe \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/search HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko)",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_icm",
"service_banner": "honeypot-sap-icm",
"service_os": "linux",
"dst_port": "8000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"mozi_pattern",
"net_sap_web_probe",
"sap_icm_emulated",
"sap_icm_payload"
]
}
12/07/2026 05:26:29 UTC
TCP
8080 · HTTP
Sonde port 8080/TCP
port 8080 tcp · via HTTP:8080 · (sonde / probe)
Élevée
Moyen · 55
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950325:rce-0
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/
Preuve honeypot — Sonde port 8080/TCP
Connexion détectée sur le port 8080 (TCP) du capteur simulé.
Pourquoi cette classification : Paramètres de scan · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 55
Confiance : Confiance 50 % — Classification nommée non retenue — preuves insuffisantes · 4 tag(s) WAF
Protocole émulé
1 Signaux
Upstream
Waf Score
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&message=%7B%7B7%2A7%7D%7D&text=%7B%7B7%2A7%7D%7D&content=%7B%7B7%2A7%7D%7D&subject=%7B%7B7%2A7%7D%7D&input=%7B%7B7%2A7%7D%7D&value=%7B%7B7%2A7%7D%7D&data=%7B%7B7%2A7%7D%7D&body=%7B%7B7%2A7%7D%7D&field=%7B%7B7%2A7%7D%7D&filter=%7B%7B7%2A7%7D%7D HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET /?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&mes
Requête brute (extrait)
GET /?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&message=%7B%7B7%2A7%7D%7D&text=%7B%7B7%2A7%7D%7D&content=%7B%7B7%2A7%7D%7D&subject=%7B%7B7%2A7%7D%7D&input=%7B%7B7%2A7%7D%7D&value=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 15,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "07b3f636f85048d240c220c68060800feecba27d",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "30d64c5e7d41f292405adaf1ced974dd64d4ba4c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 551,
"payload_entropy": 4.917684046367722,
"port_category": "registered",
"org": "Joint Stock Company TransTeleCom",
"service": "http",
"app_proto": "http",
"asn": 20485,
"country": "RU",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 55,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "12c1c07f5285e6bf01ddcbba01154cc7b719e6a1",
"event_fingerprint": "651badbfdd054bc281156406b06ee105efc77a58",
"classification_reason": "Param\u00e8tres de scan \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 55
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 20485,
"org": "Joint Stock Company TransTeleCom",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c1397ca4c438ef7fc95e8a6f78f01a9b",
"payload_hash": "46e9f561c4cc53148ca8e6b10f381e50",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"method": "GET",
"path": "\/",
"query_string": "q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&message=%7B%7B7%2A7%7D%7D&text=%7B%7B7%2A7%7D%7D&content=%7B%7B7%2A7%7D%7D&subject=%7B%7B7%2A7%7D%7D&input=%7B%7B7%2A7%7D%7D&value=%7B%7B7%2A7%7D%7D&data=%7B%7B7%2A7%7D%7D&body=%7B%7B7%2A7%7D%7D&field=%7B%7B7%2A7%7D%7D&filter=%7B%7B7%2A7%7D%7D",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950325:rce-0",
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&message=%7B%7B7%2A7%7D%7D&text=%7B%7B7%2A7%7D%7D&content=%7B%7B7%2A7%7D%7D&subject=%7B%7B7%2A7%7D%7D&input=%7B%7B7%2A7%7D%7D&value=%7B%7B7%2A7%7D%7D&data=%7B%7B7%2A7%7D%7D&body=%7B%7B7%2A7%7D%7D&field=%7B%7B7%2A7%7D%7D&filter=%7B%7B7%2A7%7D%7D HTTP\/1.1",
"payload_snippet": "GET \/?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&mes",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&message=%7B%7B7%2A7%7D%7D&text=%7B%7B7%2A7%7D%7D&content=%7B%7B7%2A7%7D%7D&subject=%7B%7B7%2A7%7D%7D&input=%7B%7B7%2A7%7D%7D&value=%7B%7B7%2A7%7D%7D&data=%7B%7B7%2A7%7D%7D&body=%7B%7B7%2A7%7D%7D&field=%7B%7B7%2A7%7D%7D&filter=%7B%7B7%2A7%7D%7D",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950325:rce-0",
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&message=%7B%7B7%2A7%7D%7D&text=%7B%7B7%2A7%7D%7D&content=%7B%7B7%2A7%7D%7D&subject=%7B%7B7%2A7%7D%7D&input=%7B%7B7%2A7%7D%7D&value=%7B%7B7%2A7%7D%7D&data=%7B%7B7%2A7%7D%7D&body=%7B%7B7%2A7%7D%7D&field=%7B%7B7%2A7%7D%7D&filter=%7B%7B7%2A7%7D%7D HTTP\/1.1",
"request_sample": "GET \/?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&message=%7B%7B7%2A7%7D%7D&text=%7B%7B7%2A7%7D%7D&content=%7B%7B7%2A7%7D%7D&subject=%7B%7B7%2A7%7D%7D&input=%7B%7B7%2A7%7D%7D&value=",
"payload_snippet": "GET \/?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&mes",
"classification_reason": "Param\u00e8tres de scan \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5b2b6259b6012474d84c8263bdef844d2faf8ff5",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&message=%7B%7B7%2A7%7D%7D&text=%7B%7B7%2A7%7D%7D&content=%7B%7B7%2A7%7D%7D\u2026",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&mes",
"attack_vector": "port 8080 tcp \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe)",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Param\u00e8tres de scan \u00b7 confiance 50%",
"classification_reason_label_fr": "Param\u00e8tres de scan \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 55
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&message=%7B%7B7%2A7%7D%7D&text=%7B%7B7%2A7%7D%7D&content=%7B%7B7%2A7%7D%7D\u2026",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 8080 tcp \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&mes",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950325:rce-0",
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_scanner_params",
"http_suspicious_params",
"net_web_probe"
]
}
12/07/2026 04:10:52 UTC
TCP
3000 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3000 · (tentative d'exploit) · → /app
Élevée
Moyen · 59
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950326:rce-0
950327:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3000
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 59
Confiance : Confiance 95 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:3000
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ch
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Length: 243 Accept: */* Connection: close Content-Type: application/x-www-form-urlencod
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "07b3f636f85048d240c220c68060800feecba27d",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 505,
"payload_entropy": 5.242154799817205,
"port_category": "registered",
"org": "Joint Stock Company TransTeleCom",
"service": "http",
"app_proto": "http",
"asn": 20485,
"country": "RU",
"dst_port": 3000,
"risk_waf": 88,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 88,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 59,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f83892a06054af6526222c52eea5ffc94b864aa7",
"event_fingerprint": "9d6283a2816f489fff6b60eca7efc9986d09a48d",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 59
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 20485,
"org": "Joint Stock Company TransTeleCom",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c1397ca4c438ef7fc95e8a6f78f01a9b",
"payload_hash": "743bbcc3d35ba0995baea7e7dd36a45f",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Ch",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nContent-Length: 243\r\nAccept: *\/*\r\nConnection: close\r\nContent-Type: application\/x-www-form-urlencod",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Ch",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nContent-Length: 243\r\nAccept: *\/*\r\nConnection: close\r\nContent-Type: application\/x-www-form-urlencod",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Ch",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3dded8f9ba5578f8bdab18e3e51d762df2204a78",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Ch",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 88,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 59
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Ch",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 88 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"net_web_probe"
]
}
12/07/2026 04:10:36 UTC
TCP
3000 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3000 · (tentative d'exploit) · → /template
Élevée
Moyen · 59
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /template UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950326:rce-0
950327:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
POST
/template
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3000
Chemin / cible
/template
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 59
Confiance : Confiance 95 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /template HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
POST /template HTTP/1.1
Host: 62.3.50.33:3000
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Geck
Requête brute (extrait)
POST /template HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Length: 243 Accept: */* Connection: close Content-Type: application/x-www-form-url
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "07b3f636f85048d240c220c68060800feecba27d",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "8eb147f68eef11c5a2bc27af5b90c78beacb36ee",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 510,
"payload_entropy": 5.238776251219774,
"port_category": "registered",
"org": "Joint Stock Company TransTeleCom",
"service": "http",
"app_proto": "http",
"asn": 20485,
"country": "RU",
"dst_port": 3000,
"risk_waf": 88,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 88,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 59,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f83892a06054af6526222c52eea5ffc94b864aa7",
"event_fingerprint": "6bc594ebffe64c6da0eb2625bece3f11454f4911",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 59
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 20485,
"org": "Joint Stock Company TransTeleCom",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c1397ca4c438ef7fc95e8a6f78f01a9b",
"payload_hash": "8d46704ea9d15d3280b6a318899504b7",
"path_pattern_hash": "0674f4d55e8e5b3c5a1876dfc7cef416"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "POST \/template HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Geck",
"method": "POST",
"path": "\/template",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/template HTTP\/1.1",
"request_sample": "POST \/template HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nContent-Length: 243\r\nAccept: *\/*\r\nConnection: close\r\nContent-Type: application\/x-www-form-url",
"payload_snippet": "POST \/template HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Geck",
"evidence": {
"method": "POST",
"path": "\/template",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/template HTTP\/1.1",
"request_sample": "POST \/template HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nContent-Length: 243\r\nAccept: *\/*\r\nConnection: close\r\nContent-Type: application\/x-www-form-url",
"payload_snippet": "POST \/template HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Geck",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "94fb5986b152f912e90c1e8edf6152432ae42bbb",
"protocol_details": {
"http_method": "POST",
"http_path": "\/template",
"request_line": "POST \/template HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/template HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Geck",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/template",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 88,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 59
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/template",
"request_line": "POST \/template HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/template",
"evidence_snippet": "POST \/template HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Geck",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 88 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"net_web_probe"
]
}
12/07/2026 04:09:50 UTC
TCP
3000 · HTTP
Sonde port 3000/TCP
port 3000 tcp · via HTTP:3000 · (sonde / probe)
Élevée
Moyen · 56
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950325:rce-0
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
3000
Chemin / cible
/
Preuve honeypot — Sonde port 3000/TCP
Connexion détectée sur le port 3000 (TCP) du capteur simulé.
Pourquoi cette classification : Paramètres de scan · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 56
Confiance : Confiance 50 % — Classification nommée non retenue — preuves insuffisantes · 4 tag(s) WAF
Protocole émulé
1 Signaux
Upstream
Waf Score
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&message=%7B%7B7%2A7%7D%7D&text=%7B%7B7%2A7%7D%7D&content=%7B%7B7%2A7%7D%7D&subject=%7B%7B7%2A7%7D%7D&input=%7B%7B7%2A7%7D%7D&value=%7B%7B7%2A7%7D%7D&data=%7B%7B7%2A7%7D%7D&body=%7B%7B7%2A7%7D%7D&field=%7B%7B7%2A7%7D%7D&filter=%7B%7B7%2A7%7D%7D HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET /?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&mes
Requête brute (extrait)
GET /?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&message=%7B%7B7%2A7%7D%7D&text=%7B%7B7%2A7%7D%7D&content=%7B%7B7%2A7%7D%7D&subject=%7B%7B7%2A7%7D%7D&input=%7B%7B7%2A7%7D%7D&value=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 4,
"http_query_params": 15,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "07b3f636f85048d240c220c68060800feecba27d",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "30d64c5e7d41f292405adaf1ced974dd64d4ba4c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 551,
"payload_entropy": 4.910529520797794,
"port_category": "registered",
"org": "Joint Stock Company TransTeleCom",
"service": "http",
"app_proto": "http",
"asn": 20485,
"country": "RU",
"dst_port": 3000,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.3,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 56,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "f957cd81223873449a2d34b587914be3bea266ff",
"event_fingerprint": "f2a6a9b28fef3b7f77242eb890e61ae7a18377e6",
"classification_reason": "Param\u00e8tres de scan \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 56
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "RU",
"asn": 20485,
"org": "Joint Stock Company TransTeleCom",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c1397ca4c438ef7fc95e8a6f78f01a9b",
"payload_hash": "46e9f561c4cc53148ca8e6b10f381e50",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"method": "GET",
"path": "\/",
"query_string": "q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&message=%7B%7B7%2A7%7D%7D&text=%7B%7B7%2A7%7D%7D&content=%7B%7B7%2A7%7D%7D&subject=%7B%7B7%2A7%7D%7D&input=%7B%7B7%2A7%7D%7D&value=%7B%7B7%2A7%7D%7D&data=%7B%7B7%2A7%7D%7D&body=%7B%7B7%2A7%7D%7D&field=%7B%7B7%2A7%7D%7D&filter=%7B%7B7%2A7%7D%7D",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950325:rce-0",
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&message=%7B%7B7%2A7%7D%7D&text=%7B%7B7%2A7%7D%7D&content=%7B%7B7%2A7%7D%7D&subject=%7B%7B7%2A7%7D%7D&input=%7B%7B7%2A7%7D%7D&value=%7B%7B7%2A7%7D%7D&data=%7B%7B7%2A7%7D%7D&body=%7B%7B7%2A7%7D%7D&field=%7B%7B7%2A7%7D%7D&filter=%7B%7B7%2A7%7D%7D HTTP\/1.1",
"payload_snippet": "GET \/?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&mes",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&message=%7B%7B7%2A7%7D%7D&text=%7B%7B7%2A7%7D%7D&content=%7B%7B7%2A7%7D%7D&subject=%7B%7B7%2A7%7D%7D&input=%7B%7B7%2A7%7D%7D&value=%7B%7B7%2A7%7D%7D&data=%7B%7B7%2A7%7D%7D&body=%7B%7B7%2A7%7D%7D&field=%7B%7B7%2A7%7D%7D&filter=%7B%7B7%2A7%7D%7D",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950325:rce-0",
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&message=%7B%7B7%2A7%7D%7D&text=%7B%7B7%2A7%7D%7D&content=%7B%7B7%2A7%7D%7D&subject=%7B%7B7%2A7%7D%7D&input=%7B%7B7%2A7%7D%7D&value=%7B%7B7%2A7%7D%7D&data=%7B%7B7%2A7%7D%7D&body=%7B%7B7%2A7%7D%7D&field=%7B%7B7%2A7%7D%7D&filter=%7B%7B7%2A7%7D%7D HTTP\/1.1",
"request_sample": "GET \/?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&message=%7B%7B7%2A7%7D%7D&text=%7B%7B7%2A7%7D%7D&content=%7B%7B7%2A7%7D%7D&subject=%7B%7B7%2A7%7D%7D&input=%7B%7B7%2A7%7D%7D&value=",
"payload_snippet": "GET \/?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&mes",
"classification_reason": "Param\u00e8tres de scan \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "407b695d3ef9d2b2a0b0fa3def356c51c56eeb03",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&message=%7B%7B7%2A7%7D%7D&text=%7B%7B7%2A7%7D%7D&content=%7B%7B7%2A7%7D%7D\u2026",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&mes",
"attack_vector": "port 3000 tcp \u00b7 via HTTP:3000 \u00b7 (sonde \/ probe)",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Param\u00e8tres de scan \u00b7 confiance 50%",
"classification_reason_label_fr": "Param\u00e8tres de scan \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 56
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&message=%7B%7B7%2A7%7D%7D&text=%7B%7B7%2A7%7D%7D&content=%7B%7B7%2A7%7D%7D\u2026",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 3000 tcp \u00b7 via HTTP:3000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/?q=%7B%7B7%2A7%7D%7D&search=%7B%7B7%2A7%7D%7D&query=%7B%7B7%2A7%7D%7D&name=%7B%7B7%2A7%7D%7D&template=%7B%7B7%2A7%7D%7D&mes",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950325:rce-0",
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_scanner_params",
"http_suspicious_params",
"net_web_probe"
]
}