|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 64.89.161.91:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.161.91:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.161.91:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
64.89.161.91:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.161.91:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "91:80",
"http_ua_hash": null,
"http_host_hash": "d1b8752d9b51dcbb076ddb98625955ff769e2231",
"http_target_hash": "d1b8752d9b51dcbb076ddb98625955ff769e2231",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.17821458607556,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "http",
"app_proto": "http",
"asn": 205759,
"country": "US",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "8df1c4938138e1882c9ddb084fa2e167a160275c",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e21c109ab57690581b05678c8d8d3182",
"path_pattern_hash": "07e50179d576e01523a74139c5c178ca"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==\r\n\r\n",
"method": "CONNECT",
"path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==",
"evidence": {
"method": "CONNECT",
"path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bf624a2638df9edaf8beefb2597fb24f7b9a43ed",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.91:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.91:80",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 64.89.161.91:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.161.91:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.161.91:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
64.89.161.91:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.161.91:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic eWxob254Z2Utcm90YXRlOnlwbmRnaW5vM2Jrdg==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "91:80",
"http_ua_hash": null,
"http_host_hash": "d1b8752d9b51dcbb076ddb98625955ff769e2231",
"http_target_hash": "d1b8752d9b51dcbb076ddb98625955ff769e2231",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 128,
"payload_entropy": 5.488936696505773,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "http",
"app_proto": "http",
"asn": 205759,
"country": "US",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "8df1c4938138e1882c9ddb084fa2e167a160275c",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e150ae8c2db5dd9464edd36de19aaec1",
"path_pattern_hash": "07e50179d576e01523a74139c5c178ca"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic eWxob254Z2Utcm90YXRlOnlwbmRnaW5vM2Jrdg==\r\n\r\n",
"method": "CONNECT",
"path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic eWxob254Z2Utcm90YXRlOnlwbmRnaW5vM2Jrdg==\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic eWxob254Z2Utcm90YXRlOnlwbmRnaW5vM2Jrdg==",
"evidence": {
"method": "CONNECT",
"path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic eWxob254Z2Utcm90YXRlOnlwbmRnaW5vM2Jrdg==\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic eWxob254Z2Utcm90YXRlOnlwbmRnaW5vM2Jrdg==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3df54471a826732075afc774422e86e5da44eb7a",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic eWxob254Z2Utcm90YXRlOnlwbmRnaW5vM2Jrdg==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.91:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.91:80",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic eWxob254Z2Utcm90YXRlOnlwbmRnaW5vM2Jrdg==",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 64.89.161.91:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.161.91:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.161.91:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
64.89.161.91:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.161.91:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic YWRtaW46YWRtaW4=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "91:80",
"http_ua_hash": null,
"http_host_hash": "d1b8752d9b51dcbb076ddb98625955ff769e2231",
"http_target_hash": "d1b8752d9b51dcbb076ddb98625955ff769e2231",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 102,
"payload_entropy": 5.006677029785867,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "http",
"app_proto": "http",
"asn": 205759,
"country": "US",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "8df1c4938138e1882c9ddb084fa2e167a160275c",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e721b1b03981c7a5920662f0b18d200c",
"path_pattern_hash": "07e50179d576e01523a74139c5c178ca"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n",
"method": "CONNECT",
"path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"evidence": {
"method": "CONNECT",
"path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "75a5718af7bf3ee18f94576d9c0e9766951ac967",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.91:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.91:80",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 64.89.161.91:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.161.91:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.161.91:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
64.89.161.91:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.161.91:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic YWRtaW46cXdlMTIzNDU=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "91:80",
"http_ua_hash": null,
"http_host_hash": "d1b8752d9b51dcbb076ddb98625955ff769e2231",
"http_target_hash": "d1b8752d9b51dcbb076ddb98625955ff769e2231",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.215103359862564,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "http",
"app_proto": "http",
"asn": 205759,
"country": "US",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "8df1c4938138e1882c9ddb084fa2e167a160275c",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f617e640c3fe9ac8acc6d532756940ca",
"path_pattern_hash": "07e50179d576e01523a74139c5c178ca"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46cXdlMTIzNDU=\r\n\r\n",
"method": "CONNECT",
"path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46cXdlMTIzNDU=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46cXdlMTIzNDU=",
"evidence": {
"method": "CONNECT",
"path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46cXdlMTIzNDU=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46cXdlMTIzNDU=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1a0a7aa3d6d781e81f41c1257d772752ff078902",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46cXdlMTIzNDU=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.91:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.91:80",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46cXdlMTIzNDU=",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 64.89.161.91:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.161.91:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.161.91:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
64.89.161.91:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.161.91:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic cm9vdDokUHIwZE4wZGUk
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "91:80",
"http_ua_hash": null,
"http_host_hash": "d1b8752d9b51dcbb076ddb98625955ff769e2231",
"http_target_hash": "d1b8752d9b51dcbb076ddb98625955ff769e2231",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.211728100819968,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "http",
"app_proto": "http",
"asn": 205759,
"country": "US",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "8df1c4938138e1882c9ddb084fa2e167a160275c",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "78506b4c4caa70e7cd07c02a8dfbf8fb",
"path_pattern_hash": "07e50179d576e01523a74139c5c178ca"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDokUHIwZE4wZGUk\r\n\r\n",
"method": "CONNECT",
"path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDokUHIwZE4wZGUk\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDokUHIwZE4wZGUk",
"evidence": {
"method": "CONNECT",
"path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDokUHIwZE4wZGUk\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDokUHIwZE4wZGUk",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f790dcf4062ebccf56a29bc404593aa3250c9f41",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDokUHIwZE4wZGUk",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.91:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.91:80",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDokUHIwZE4wZGUk",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 64.89.161.91:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.161.91:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.161.91:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
64.89.161.91:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.161.91:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic YWRtaW46YWRtaW4=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "91:80",
"http_ua_hash": null,
"http_host_hash": "d1b8752d9b51dcbb076ddb98625955ff769e2231",
"http_target_hash": "d1b8752d9b51dcbb076ddb98625955ff769e2231",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 104,
"payload_entropy": 5.004319017769869,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "http",
"app_proto": "http",
"asn": 205759,
"country": "US",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "8df1c4938138e1882c9ddb084fa2e167a160275c",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2e02bbc0f19d8d0238d4339ecf993639",
"path_pattern_hash": "07e50179d576e01523a74139c5c178ca"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"method": "CONNECT",
"path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"evidence": {
"method": "CONNECT",
"path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ec5ae775dff6c4ed235b30ae2a29b45ca8c4e673",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.91:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.91:80",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 64.89.161.91:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.161.91:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.161.91:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
64.89.161.91:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.161.91:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "91:80",
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "d1b8752d9b51dcbb076ddb98625955ff769e2231",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 34,
"payload_entropy": 4.065260267657297,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "http",
"app_proto": "http",
"asn": 205759,
"country": "US",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "8df1c4938138e1882c9ddb084fa2e167a160275c",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6b33f31952322e49561d89b561aab435",
"path_pattern_hash": "07e50179d576e01523a74139c5c178ca"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\n",
"method": "CONNECT",
"path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0",
"evidence": {
"method": "CONNECT",
"path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7a7180c1f97cc11ff752d1f17102a03aef69cafc",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.91:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.91:80",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 64.89.161.91:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.161.91:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.161.91:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
64.89.161.91:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.161.91:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "91:80",
"http_ua_hash": null,
"http_host_hash": "d1b8752d9b51dcbb076ddb98625955ff769e2231",
"http_target_hash": "d1b8752d9b51dcbb076ddb98625955ff769e2231",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 59,
"payload_entropy": 4.190570271026463,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "http",
"app_proto": "http",
"asn": 205759,
"country": "US",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "8df1c4938138e1882c9ddb084fa2e167a160275c",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0225033c032bdc22a8f420899ae02db2",
"path_pattern_hash": "07e50179d576e01523a74139c5c178ca"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\n\r\n",
"method": "CONNECT",
"path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80",
"evidence": {
"method": "CONNECT",
"path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "51960907d529b535a2a2723a92905cd66da1260d",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.91:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.161.91:80",
"request_line": "CONNECT 64.89.161.91:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.91:80",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8090 · HTTP ALT 8090
|
http-alt-8090
|
Flood / DDoS
http flood · via HTTP ALT 8090:8090 · (tentative d'exploit)
|
Faible
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTP-ALT-8090
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8090
Chemin / cible
—
Service
HTTP ALT 8090
Payload
CONNECT 64.89.161.91:80 HTTP/1.0 Host: 64.89.161.91:80 Proxy-Authorization: Basic dXNlcjE6cGFzczE=
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic dXNlcjE6cGFzczE=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 104,
"payload_entropy": 5.106146810710089,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "http-alt-8090",
"app_proto": "http-alt-8090",
"asn": 205759,
"country": "US",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15
},
"risk_score": 46,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "074fcf7b6621f792f12eafd4c85696050ae26041",
"event_fingerprint": "73de1024b23993e40693db328fc9a5b5266e5167",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "http-alt-8090",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7cd58d579b67a8be1ae0f4fb27c5e314",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8090,
"service": "http-alt-8090",
"service_name": "http-alt-8090",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n\r\n",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=",
"evidence": {
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e26ecf61a76409b1bb82ce5e5b7ec05b426b33f0",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=",
"port": 8090,
"service": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=",
"attack_vector": "http flood \u00b7 via HTTP ALT 8090:8090 \u00b7 (tentative d'exploit)",
"target_port_label": "8090 \u00b7 HTTP ALT 8090",
"emulator_service": "http-alt-8090",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTP ALT 8090",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8090",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=",
"port": 8090,
"service": "http-alt-8090",
"service_label_fr": "HTTP ALT 8090"
},
"attack_vector": "http flood \u00b7 via HTTP ALT 8090:8090 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=",
"target_port_label": "8090 \u00b7 HTTP ALT 8090",
"emulator_service": "http-alt-8090",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8090",
"service_banner": "honeypot-http-alt-8090",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
30007 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:30007 · (sonde / probe) · → 1.1.1.1:443
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 1.1.1.1:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
1.1.1.1:443
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
30007
Chemin / cible
1.1.1.1:443
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
82%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 1.1.1.1:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 1.1.1.1:443 HTTP/1.0
Host: 1.1.1.1
Meta JSON brut
{
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "1:443",
"http_ua_hash": null,
"http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f",
"http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 47,
"payload_entropy": 3.912028011761936,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "http",
"app_proto": "http",
"asn": 205759,
"country": "US",
"dst_port": 30007,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "e531067c8ad694ef7b90ffb98cc8873c247d8058",
"event_fingerprint": "4eab02edca3ad1fa4800f3d6c44eb076c1acfd97",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "eca058040bfea8cad9218ced7d8b12d9",
"path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4"
},
"service_name": "http",
"target_context": {
"dst_port": 30007,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
"method": "CONNECT",
"path": "1.1.1.1:443",
"request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
"request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
"payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
"evidence": {
"method": "CONNECT",
"path": "1.1.1.1:443",
"request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
"request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
"payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.82,
"classification_confidence": 0.82,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8342f485685f2b0eee823d5f07a60a769b689435",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "1.1.1.1:443",
"request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
"port": 30007,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:30007 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
"target_port_label": "30007 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 82,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 30007,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "1.1.1.1:443",
"request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
"port": 30007,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:30007 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
"evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
"target_port_label": "30007 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "30007"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:30007"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
30007
|
—
|
proxy probe
proxy probe · port 30007 · (sonde / probe)
|
Élevée
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
30007
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 1 signal(aux) capteur
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 1.4466166676282082,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": null,
"app_proto": null,
"asn": 205759,
"country": "US",
"dst_port": 30007,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 24,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "9965c9d3260a44efd3b0c51fc4ea2b59c3ee0350",
"event_fingerprint": "a345da1bd6e90226170cc61530894e75dbe47ee5",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 24
},
"named_classification_skipped": false,
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6266f12abef0bbe34ce5d154de5a6068",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 30007,
"risk_score": 24
},
"payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b265c5ffbad0a81b3f2edd3bedcb28bd0ed8e4cf",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"port": 30007
},
"evidence_snippet": "\ufffd",
"attack_vector": "proxy probe \u00b7 port 30007 \u00b7 (sonde \/ probe)",
"target_port_label": "30007",
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 24
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 30007,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"port": 30007
},
"attack_vector": "proxy probe \u00b7 port 30007 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd",
"target_port_label": "30007",
"emulator_service": null,
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "30007"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"socks4_greeting"
]
}
|
|
|
TCP |
30007
|
—
|
Sonde port
Sonde port · port 30007 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
30007
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 4,
"payload_entropy": 1.5,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": null,
"app_proto": null,
"asn": 205759,
"country": "US",
"dst_port": 30007,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "f8a6ad145222b507891870c84b79182dba3eb106",
"event_fingerprint": "8e0a0d05f6b64a2f073ec31ff87a7c89a363e80d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 30007,
"risk_score": 44
},
"payload_preview": "\u0005\u0002\u0000\u0002",
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"evidence": {
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "76605a35e57e2785096a48d381e6a88950e4b8c7",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 30007
},
"attack_vector": "Sonde port \u00b7 port 30007 \u00b7 (sonde \/ probe)",
"target_port_label": "30007",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 30007,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 30007
},
"attack_vector": "Sonde port \u00b7 port 30007 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "30007",
"emulator_service": null,
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "30007"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
30007
|
—
|
Sonde port
Sonde port · port 30007 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
30007
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": null,
"app_proto": null,
"asn": 205759,
"country": "US",
"dst_port": 30007,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "f8a6ad145222b507891870c84b79182dba3eb106",
"event_fingerprint": "8e0a0d05f6b64a2f073ec31ff87a7c89a363e80d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 30007,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "af364095cce5e84a1e39a281e1d1e4590a32b283",
"protocol_details": {
"port": 30007
},
"attack_vector": "Sonde port \u00b7 port 30007 \u00b7 (sonde \/ probe)",
"target_port_label": "30007",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 30007,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 30007
},
"attack_vector": "Sonde port \u00b7 port 30007 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "30007",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "30007"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
7985
|
—
|
Sonde port
Sonde port · port 7985 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7985
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 4,
"payload_entropy": 1.5,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": null,
"app_proto": null,
"asn": 205759,
"country": "US",
"dst_port": 7985,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "39946e4dfae3221709eee1f4c6d3645c065d1d34",
"event_fingerprint": "6e9d08943a016e258209e19139a9aee9d4cd8e58",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 7985,
"risk_score": 44
},
"payload_preview": "\u0005\u0002\u0000\u0002",
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"evidence": {
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "30b31040c34421e24b3acb1cb57eb35afa8dab7a",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 7985
},
"attack_vector": "Sonde port \u00b7 port 7985 \u00b7 (sonde \/ probe)",
"target_port_label": "7985",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 7985,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 7985
},
"attack_vector": "Sonde port \u00b7 port 7985 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "7985",
"emulator_service": null,
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "7985"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
7985
|
—
|
proxy probe
proxy probe · port 7985 · (sonde / probe)
|
Élevée
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7985
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 1 signal(aux) capteur
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 1.4466166676282082,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": null,
"app_proto": null,
"asn": 205759,
"country": "US",
"dst_port": 7985,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 24,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "4fe455862a2a0f7224e16d43715cbccb8eb5964f",
"event_fingerprint": "88b018765c3049b3c127d9fd4ea6600ed95de544",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 24
},
"named_classification_skipped": false,
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6266f12abef0bbe34ce5d154de5a6068",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 7985,
"risk_score": 24
},
"payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1523ca8e0ec2b23564edc0250859eaaf84a05fa1",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"port": 7985
},
"evidence_snippet": "\ufffd",
"attack_vector": "proxy probe \u00b7 port 7985 \u00b7 (sonde \/ probe)",
"target_port_label": "7985",
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 24
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 7985,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"port": 7985
},
"attack_vector": "proxy probe \u00b7 port 7985 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd",
"target_port_label": "7985",
"emulator_service": null,
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "7985"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"socks4_greeting"
]
}
|
|
|
TCP |
7985 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:7985 · (sonde / probe) · → 1.1.1.1:443
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 1.1.1.1:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
1.1.1.1:443
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
7985
Chemin / cible
1.1.1.1:443
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
82%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 1.1.1.1:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 1.1.1.1:443 HTTP/1.0
Host: 1.1.1.1
Meta JSON brut
{
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "1:443",
"http_ua_hash": null,
"http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f",
"http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 47,
"payload_entropy": 3.912028011761936,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "http",
"app_proto": "http",
"asn": 205759,
"country": "US",
"dst_port": 7985,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a9b81f57ee28eb1a09b4cf144a31c1f4f4f86261",
"event_fingerprint": "671461d93031af88cd56a6a4486fa61a0e86f524",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "eca058040bfea8cad9218ced7d8b12d9",
"path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4"
},
"service_name": "http",
"target_context": {
"dst_port": 7985,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
"method": "CONNECT",
"path": "1.1.1.1:443",
"request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
"request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
"payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
"evidence": {
"method": "CONNECT",
"path": "1.1.1.1:443",
"request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
"request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
"payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.82,
"classification_confidence": 0.82,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "aecc758f1e3cc445c2e2511c50d6cc966fc7c792",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "1.1.1.1:443",
"request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
"port": 7985,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:7985 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
"target_port_label": "7985 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 82,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7985,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "1.1.1.1:443",
"request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
"port": 7985,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:7985 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
"evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
"target_port_label": "7985 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7985"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:7985"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
|
|
|
TCP |
7985
|
—
|
Sonde port
Sonde port · port 7985 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7985
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": null,
"app_proto": null,
"asn": 205759,
"country": "US",
"dst_port": 7985,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "39946e4dfae3221709eee1f4c6d3645c065d1d34",
"event_fingerprint": "6e9d08943a016e258209e19139a9aee9d4cd8e58",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 7985,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7531285436af6bb469b2169768e46b5e0296b3e0",
"protocol_details": {
"port": 7985
},
"attack_vector": "Sonde port \u00b7 port 7985 \u00b7 (sonde \/ probe)",
"target_port_label": "7985",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 7985,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 7985
},
"attack_vector": "Sonde port \u00b7 port 7985 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "7985",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "7985"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-libssh_0.11.4 lV�ʨ�N�0����:� hcurve25519-sha256…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-libssh_0.11.4 lV�ʨ�N�0����:� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sh…
Payload
SSH-2.0-libssh_0.11.4 lV�ʨ�N�0����:� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
pat-0392
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
libssh banner
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-libssh_0.11.4
lV�ʨ�N�0����:� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis
Requête brute (extrait)
SSH-2.0-libssh_0.11.4 lV�ʨ�N�0����:� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
"emulator_response_len": 32,
"bytes_in": 1159,
"payload_entropy": 4.842100677754845,
"port_category": "well_known",
"org": "Ghosty Networks LLC",
"service": "ssh",
"app_proto": "ssh",
"asn": 205759,
"country": "US",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"libssh banner",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e0864832614efac3205833d7e8fb1013",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\u000eV\ufffd\u02a8\ufffdN\ufffd0\ufffd\ufffd\ufffd\ufffd:\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\u000eV\ufffd\u02a8\ufffdN\ufffd0\ufffd\ufffd\ufffd\ufffd:\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
"payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\u000eV\ufffd\u02a8\ufffdN\ufffd0\ufffd\ufffd\ufffd\ufffd:\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"evidence": {
"request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\u000eV\ufffd\u02a8\ufffdN\ufffd0\ufffd\ufffd\ufffd\ufffd:\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
"payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\u000eV\ufffd\u02a8\ufffdN\ufffd0\ufffd\ufffd\ufffd\ufffd:\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8a11471bd65ec73ae12d356667f4af162d29f511",
"protocol_details": {
"ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\u000eV\ufffd\u02a8\ufffdN\ufffd0\ufffd\ufffd\ufffd\ufffd:\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\u000eV\ufffd\u02a8\ufffdN\ufffd0\ufffd\ufffd\ufffd\ufffd:\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nlV\ufffd\u02a8\ufffdN\ufffd0\ufffd\ufffd\ufffd\ufffd:\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"pat-0392",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\u000eV\ufffd\u02a8\ufffdN\ufffd0\ufffd\ufffd\ufffd\ufffd:\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\u000eV\ufffd\u02a8\ufffdN\ufffd0\ufffd\ufffd\ufffd\ufffd:\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nlV\ufffd\u02a8\ufffdN\ufffd0\ufffd\ufffd\ufffd\ufffd:\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
|
|
|
TCP |
8000 · SAP ICM
|
sap-icm
|
Flood / DDoS
http flood · via SAP ICM:8000 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SAP-ICM
WAF
—
Recommandation
Surveiller
Tags
net_sap_web_probe
sap_icm_emulated
sap_icm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8000
Chemin / cible
—
Service
SAP ICM
Payload
CONNECT 64.89.161.91:80 HTTP/1.0
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c",
"emulator_response_len": 141,
"bytes_in": 34,
"payload_entropy": 4.065260267657297,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "sap-icm",
"app_proto": "sap-icm",
"asn": 205759,
"country": "US",
"dst_port": 8000,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 38,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 0
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "04ada829cf80285c4a0f515b998f0122f0ce49cc",
"event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 0,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "sap-icm",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6b33f31952322e49561d89b561aab435",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8000,
"service": "sap-icm",
"service_name": "sap-icm",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\n",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0",
"evidence": {
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c6167e7b36b734b63638ac6b32a9c07e9024028a",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0",
"attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via SAP ICM",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 0,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "sap-icm",
"service_label_fr": "SAP ICM",
"dst_port": 8000,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-icm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_icm",
"service_banner": "honeypot-sap-icm",
"service_os": "linux",
"dst_port": "8000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_sap_web_probe",
"sap_icm_emulated",
"sap_icm_payload"
]
}
|
|
|
TCP |
413
|
—
|
Sonde port
Sonde port · port 413 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
413
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "well_known",
"org": "Ghosty Networks LLC",
"service": null,
"app_proto": null,
"asn": 205759,
"country": "US",
"dst_port": 413,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3119250f08afcd9a9351de054deae1666eb3a71f",
"event_fingerprint": "0c80329f6f528378965098f516c94b8f448e01fc",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 413,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e6443a5efb4cb1eb716c0a7b2c06460bb06fd6e4",
"protocol_details": {
"port": 413
},
"attack_vector": "Sonde port \u00b7 port 413 \u00b7 (sonde \/ probe)",
"target_port_label": "413",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 413,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 413
},
"attack_vector": "Sonde port \u00b7 port 413 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "413",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "413"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
socks5 probe
socks5 probe · via SOCKS5:1080 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
socks5_handshake
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0500",
"emulator_response_len": 2,
"bytes_in": 4,
"payload_entropy": 1.5,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "socks5",
"app_proto": "socks5",
"asn": 205759,
"country": "US",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "socks5",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
"path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 45
},
"payload_preview": "\u0005\u0002\u0000\u0002",
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"evidence": {
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"network_service_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated",
"socks5_handshake"
]
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
socks5 probe
socks5 probe · via SOCKS5:1080 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
socks5_handshake
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0500",
"emulator_response_len": 2,
"bytes_in": 4,
"payload_entropy": 1.5,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "socks5",
"app_proto": "socks5",
"asn": 205759,
"country": "US",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "socks5",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
"path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 45
},
"payload_preview": "\u0005\u0002\u0000\u0002",
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"evidence": {
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"network_service_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated",
"socks5_handshake"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 64.89.161.91:80 HTTP/1.0 Host: 64.89.161.91:80 Proxy-Authorization: Basic YWFhOmNocmlz
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic YWFhOmNocmlz
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 98,
"payload_entropy": 5.065664309698635,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 205759,
"country": "US",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "00a5fe6751e8eb85da0a65dd71099c2e",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWFhOmNocmlz\r\n",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWFhOmNocmlz\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWFhOmNocmlz",
"evidence": {
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWFhOmNocmlz\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWFhOmNocmlz",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e5545badf14b55e6c26cfce76e2179ca628b862e",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWFhOmNocmlz",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWFhOmNocmlz",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWFhOmNocmlz",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWFhOmNocmlz",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 64.89.161.91:80 HTTP/1.0 Host: 64.89.161.91:80 Proxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 106,
"payload_entropy": 5.130597460439128,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 205759,
"country": "US",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7ed0df08c232ff7936401ee836893482",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"evidence": {
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "494fea39d65afc5b88cb4d11cd86421c94bbb507",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 64.89.161.91:80 HTTP/1.0 Host: 64.89.161.91:80 Proxy-Authorization: Basic cm9vdDpUZW1wMTIz
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic cm9vdDpUZW1wMTIz
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 104,
"payload_entropy": 5.18952214208564,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 205759,
"country": "US",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "410ec43fcd6776c40ed2868c90c2abbc",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpUZW1wMTIz\r\n\r\n",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpUZW1wMTIz\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpUZW1wMTIz",
"evidence": {
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpUZW1wMTIz\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpUZW1wMTIz",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ca269d3be9c56de6913da4d3aec551aa947d5e04",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpUZW1wMTIz",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpUZW1wMTIz",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpUZW1wMTIz",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpUZW1wMTIz",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 64.89.161.91:80 HTTP/1.0 Host: 64.89.161.91:80 Proxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 108,
"payload_entropy": 5.127049887600278,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 205759,
"country": "US",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e702ae7cbff2913c73bd978cd55d04dd",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n\r\n",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"evidence": {
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e07bd104cd42f24f455f3eedea1d51596a2aa096",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 64.89.161.91:80 HTTP/1.0 Host: 64.89.161.91:80 Proxy-Authorization: Basic cm9vdDpKaW5ndWl4dW4zMjIwOTMw
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic cm9vdDpKaW5ndWl4dW4zMjIwOTMw
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 114,
"payload_entropy": 5.319193962629763,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 205759,
"country": "US",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3870cda07a13d9b228ec33c1bfcf62df",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpKaW5ndWl4dW4zMjIwOTMw\r\n",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpKaW5ndWl4dW4zMjIwOTMw\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpKaW5ndWl4dW4zMjIwOTMw",
"evidence": {
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpKaW5ndWl4dW4zMjIwOTMw\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpKaW5ndWl4dW4zMjIwOTMw",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "227b390086411e1158cca0a0c39ed34148cf3b99",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpKaW5ndWl4dW4zMjIwOTMw",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpKaW5ndWl4dW4zMjIwOTMw",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpKaW5ndWl4dW4zMjIwOTMw",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpKaW5ndWl4dW4zMjIwOTMw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 64.89.161.91:80 HTTP/1.0 Host: 64.89.161.91:80 Proxy-Authorization: Basic dXNlcjE6cGFzczE=
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic dXNlcjE6cGFzczE=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 102,
"payload_entropy": 5.110501446117072,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 205759,
"country": "US",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6dfd847b6295d7b4c09e87ea7d74745b",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=",
"evidence": {
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ef468b3c970334055d2227c5051bd36252c982e1",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 64.89.161.91:80 HTTP/1.0 Host: 64.89.161.91:80 Proxy-Authorization: Basic MTox
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic MTox
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 90,
"payload_entropy": 4.888556570013035,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 205759,
"country": "US",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "be1ab370df43d71ead39f162ae45dbf6",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTox\r\n",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTox\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTox",
"evidence": {
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTox\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTox",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b06ba71830cf974ba8860f22aa31c0d1d40bffe",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTox",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTox",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTox",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTox",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 64.89.161.91:80 HTTP/1.0 Host: 64.89.161.91:80 Proxy-Authorization: Basic YmViZXRvOmJlYmV0bw==
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic YmViZXRvOmJlYmV0bw==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 108,
"payload_entropy": 5.262505355036303,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 205759,
"country": "US",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7ab25811ebf47a2dc3c6c237a5ea42b9",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==\r\n\r\n",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==",
"evidence": {
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d6259d17718055319d5d0d0c7b27e12fdb88f278",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 64.89.161.91:80 HTTP/1.0 Host: 64.89.161.91:80 Proxy-Authorization: Basic bmFnaW9zOmFiY0AxMjM0NTY3
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic bmFnaW9zOmFiY0AxMjM0NTY3
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 110,
"payload_entropy": 5.182211278588893,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 205759,
"country": "US",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4e6fa167afdcf1f84e5c4d0aca155a95",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic bmFnaW9zOmFiY0AxMjM0NTY3\r\n",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic bmFnaW9zOmFiY0AxMjM0NTY3\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic bmFnaW9zOmFiY0AxMjM0NTY3",
"evidence": {
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic bmFnaW9zOmFiY0AxMjM0NTY3\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic bmFnaW9zOmFiY0AxMjM0NTY3",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9ead04c8ae8e18d6f7aaae4c8223b9e3f5e7cc28",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic bmFnaW9zOmFiY0AxMjM0NTY3",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic bmFnaW9zOmFiY0AxMjM0NTY3",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic bmFnaW9zOmFiY0AxMjM0NTY3",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic bmFnaW9zOmFiY0AxMjM0NTY3",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 64.89.161.91:80 HTTP/1.0 Host: 64.89.161.91:80 Proxy-Authorization: Basic dXNlcjEyMzoxMjM0NTY=
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic dXNlcjEyMzoxMjM0NTY=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 106,
"payload_entropy": 5.140215856747182,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 205759,
"country": "US",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "43bf3114beef8b910097b39141abc659",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjEyMzoxMjM0NTY=\r\n",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjEyMzoxMjM0NTY=\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjEyMzoxMjM0NTY=",
"evidence": {
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjEyMzoxMjM0NTY=\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjEyMzoxMjM0NTY=",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4f742b02b8f595b3b4095a1b4b9abe58f80ac529",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjEyMzoxMjM0NTY=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjEyMzoxMjM0NTY=",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjEyMzoxMjM0NTY=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjEyMzoxMjM0NTY=",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-libssh_0.11.4 l�2�*X�aR �E�: hcurve25519-sha2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-libssh_0.11.4 l�2�*X�aR �E�: hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-…
Payload
SSH-2.0-libssh_0.11.4 l�2�*X�aR �E�: hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
pat-0392
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
libssh banner
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-libssh_0.11.4
l�2�*X�aR �E�: hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis
Requête brute (extrait)
SSH-2.0-libssh_0.11.4 l�2�*X�aR �E�: hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
"emulator_response_len": 39,
"bytes_in": 1159,
"payload_entropy": 4.834718502386887,
"port_category": "well_known",
"org": "Ghosty Networks LLC",
"service": "ssh",
"app_proto": "ssh",
"asn": 205759,
"country": "US",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"libssh banner",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f5be956532cae12afa89b2bae71cbb62",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u00122\u0003\ufffd*X\u000e\ufffdaR\u001f\ufffdE\ufffd:\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u00122\u0003\ufffd*X\u000e\ufffdaR\u001f\ufffdE\ufffd:\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
"payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u00122\u0003\ufffd*X\u000e\ufffdaR\u001f\ufffdE\ufffd:\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"evidence": {
"request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u00122\u0003\ufffd*X\u000e\ufffdaR\u001f\ufffdE\ufffd:\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
"payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u00122\u0003\ufffd*X\u000e\ufffdaR\u001f\ufffdE\ufffd:\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f2130ee05049b8e351e94ca29d475f1775ab6452",
"protocol_details": {
"ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u00122\u0003\ufffd*X\u000e\ufffdaR\u001f\ufffdE\ufffd:\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u00122\u0003\ufffd*X\u000e\ufffdaR\u001f\ufffdE\ufffd:\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffd2\ufffd*X\ufffdaR\ufffdE\ufffd:hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"pat-0392",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u00122\u0003\ufffd*X\u000e\ufffdaR\u001f\ufffdE\ufffd:\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u00122\u0003\ufffd*X\u000e\ufffdaR\u001f\ufffdE\ufffd:\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffd2\ufffd*X\ufffdaR\ufffdE\ufffd:hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-libssh_0.11.4 lJ�f�D b��RHYJ� hcurve25519-sha25…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-libssh_0.11.4 lJ�f�D b��RHYJ� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-s…
Payload
SSH-2.0-libssh_0.11.4 lJ�f�D b��RHYJ� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
pat-0392
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
libssh banner
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-libssh_0.11.4
lJ�f�D b��RHYJ� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis
Requête brute (extrait)
SSH-2.0-libssh_0.11.4 lJ�f�D b��RHYJ� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
"emulator_response_len": 40,
"bytes_in": 1159,
"payload_entropy": 4.831787060515785,
"port_category": "well_known",
"org": "Ghosty Networks LLC",
"service": "ssh",
"app_proto": "ssh",
"asn": 205759,
"country": "US",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"libssh banner",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "90c5d46640316dcbbe959c9ad59eb77b",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014J\ufffdf\ufffd\u0004D\u001db\ufffd\ufffdRHYJ\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014J\ufffdf\ufffd\u0004D\u001db\ufffd\ufffdRHYJ\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
"payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014J\ufffdf\ufffd\u0004D\u001db\ufffd\ufffdRHYJ\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"evidence": {
"request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014J\ufffdf\ufffd\u0004D\u001db\ufffd\ufffdRHYJ\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
"payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014J\ufffdf\ufffd\u0004D\u001db\ufffd\ufffdRHYJ\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "298645c7433297d5eff955485e7b630fc02286a2",
"protocol_details": {
"ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014J\ufffdf\ufffd\u0004D\u001db\ufffd\ufffdRHYJ\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014J\ufffdf\ufffd\u0004D\u001db\ufffd\ufffdRHYJ\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nlJ\ufffdf\ufffdDb\ufffd\ufffdRHYJ\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"pat-0392",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014J\ufffdf\ufffd\u0004D\u001db\ufffd\ufffdRHYJ\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014J\ufffdf\ufffd\u0004D\u001db\ufffd\ufffdRHYJ\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nlJ\ufffdf\ufffdDb\ufffd\ufffdRHYJ\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 64.89.161.91:80 HTTP/1.0 Host: 64.89.161.91:80 Proxy-Authorization: Basic cm9vdDphbGl5YQ==
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic cm9vdDphbGl5YQ==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 104,
"payload_entropy": 5.243307027118653,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 205759,
"country": "US",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5cf754b7ecb426ee7dabeb81287153fa",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDphbGl5YQ==\r\n\r\n",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDphbGl5YQ==\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDphbGl5YQ==",
"evidence": {
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDphbGl5YQ==\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDphbGl5YQ==",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2d8984148997e0cf4a07b1cdc8ff8d55b2fbd1d7",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDphbGl5YQ==",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDphbGl5YQ==",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDphbGl5YQ==",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDphbGl5YQ==",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 64.89.161.91:80 HTTP/1.0 Host: 64.89.161.91:80 Proxy-Authorization: Basic MTIzOjQ1Ng==
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic MTIzOjQ1Ng==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 100,
"payload_entropy": 5.061049440399789,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 205759,
"country": "US",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9085ce59ab07af249c26918124da1527",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==\r\n\r\n",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==",
"evidence": {
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4bdb8da901afb9b597256bc3200a72c936b8432d",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 64.89.161.91:80 HTTP/1.0 Host: 64.89.161.91:80 Proxy-Authorization: Basic dWJudDpxd2VydHk=
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic dWJudDpxd2VydHk=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 104,
"payload_entropy": 5.174602728775126,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 205759,
"country": "US",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bcb382869d457dd497fe8672028bd12d",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dWJudDpxd2VydHk=\r\n\r\n",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dWJudDpxd2VydHk=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dWJudDpxd2VydHk=",
"evidence": {
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dWJudDpxd2VydHk=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dWJudDpxd2VydHk=",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6795d5cfce8942d4c72c0e02f55f0ad9ed1b4f19",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dWJudDpxd2VydHk=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dWJudDpxd2VydHk=",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dWJudDpxd2VydHk=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dWJudDpxd2VydHk=",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 64.89.161.91:80 HTTP/1.0 Host: 64.89.161.91:80 Proxy-Authorization: Basic cm9vdDpwYW5hc29uaWM=
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic cm9vdDpwYW5hc29uaWM=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 108,
"payload_entropy": 5.2460753780842895,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 205759,
"country": "US",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2d9451850808d5ed98162770894e91b1",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpwYW5hc29uaWM=\r\n\r\n",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpwYW5hc29uaWM=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpwYW5hc29uaWM=",
"evidence": {
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpwYW5hc29uaWM=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpwYW5hc29uaWM=",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6f76c23dd083175c7b7295247b6bb0a2e51ddf68",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpwYW5hc29uaWM=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpwYW5hc29uaWM=",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpwYW5hc29uaWM=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpwYW5hc29uaWM=",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 64.89.161.91:80 HTTP/1.0 Host: 64.89.161.91:80 Proxy-Authorization: Basic MTIzNDU6MTIzNDU=
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic MTIzNDU6MTIzNDU=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 104,
"payload_entropy": 5.054752791787529,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 205759,
"country": "US",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "24829e35cd6922fdd483656620e6f7f4",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=",
"evidence": {
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d60ee2a5bbc51c42a73fd0b4c17174593a1e3c29",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 64.89.161.91:80 HTTP/1.0 Host: 64.89.161.91:80 Proxy-Authorization: Basic cm9vdDpTa3lpbm5vQCMlMTEz
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic cm9vdDpTa3lpbm5vQCMlMTEz
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 112,
"payload_entropy": 5.254619852031404,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 205759,
"country": "US",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c004db21897fbcacc5d0b9b7a852f068",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpTa3lpbm5vQCMlMTEz\r\n\r\n",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpTa3lpbm5vQCMlMTEz\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpTa3lpbm5vQCMlMTEz",
"evidence": {
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpTa3lpbm5vQCMlMTEz\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpTa3lpbm5vQCMlMTEz",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "66341f853dad964f487a242b67adb60d07fb69cd",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpTa3lpbm5vQCMlMTEz",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpTa3lpbm5vQCMlMTEz",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpTa3lpbm5vQCMlMTEz",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpTa3lpbm5vQCMlMTEz",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 64.89.161.91:80 HTTP/1.0 Host: 64.89.161.91:80 Proxy-Authorization: Basic YWRtaW46YWRtaW4=
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic YWRtaW46YWRtaW4=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 104,
"payload_entropy": 5.004319017769869,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 205759,
"country": "US",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2e02bbc0f19d8d0238d4339ecf993639",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"evidence": {
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "08fb6cd202505af2549a0c8d47b624686e08a16b",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 64.89.161.91:80 HTTP/1.0 Host: 64.89.161.91:80 Proxy-Authorization: Basic dXNlcjE6MTIzNDU2
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic dXNlcjE6MTIzNDU2
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 104,
"payload_entropy": 5.154411714639455,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 205759,
"country": "US",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7ba0b2513651ab2f81734f845676afec",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjE6MTIzNDU2\r\n\r\n",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjE6MTIzNDU2\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjE6MTIzNDU2",
"evidence": {
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjE6MTIzNDU2\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjE6MTIzNDU2",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8aef967a7b32ad3dd24ba486bbbe34445c11702a",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjE6MTIzNDU2",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjE6MTIzNDU2",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjE6MTIzNDU2",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dXNlcjE6MTIzNDU2",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 64.89.161.91:80 HTTP/1.0 Host: 64.89.161.91:80 Proxy-Authorization: Basic dGVzdDp0ZXN0
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic dGVzdDp0ZXN0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 98,
"payload_entropy": 5.093775406659487,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 205759,
"country": "US",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8487905e7b094852533680f0a5a7e509",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"evidence": {
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cee372588cdc7594a2998bbd9c13cd0eed646027",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 64.89.161.91:80 HTTP/1.0 Host: 64.89.161.91:80 Proxy-Authorization: Basic cm9vdDpwYXNzMTIzNDU=
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic cm9vdDpwYXNzMTIzNDU=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 106,
"payload_entropy": 5.246301823707903,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 205759,
"country": "US",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3f3f0133758071e35f2bef377305a83e",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzMTIzNDU=\r\n",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzMTIzNDU=\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzMTIzNDU=",
"evidence": {
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzMTIzNDU=\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzMTIzNDU=",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8f4d82dd8fdca251ec0767b404216e7575f8baa3",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzMTIzNDU=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzMTIzNDU=",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzMTIzNDU=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzMTIzNDU=",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 64.89.161.91:80 HTTP/1.0 Host: 64.89.161.91:80 Proxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 108,
"payload_entropy": 5.127049887600278,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 205759,
"country": "US",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e702ae7cbff2913c73bd978cd55d04dd",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n\r\n",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"evidence": {
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e07bd104cd42f24f455f3eedea1d51596a2aa096",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 64.89.161.91:80 HTTP/1.0
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 34,
"payload_entropy": 4.065260267657297,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 205759,
"country": "US",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6b33f31952322e49561d89b561aab435",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\n",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0",
"evidence": {
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c5777ee73042626eedcbb11ab16bf6c6874f0776",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 64.89.161.91:80 HTTP/1.0 Host: 64.89.161.91:80 Proxy-Authorization: Basic YWRtaW46YWRtaW4=
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic YWRtaW46YWRtaW4=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 102,
"payload_entropy": 5.006677029785867,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 205759,
"country": "US",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e721b1b03981c7a5920662f0b18d200c",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"evidence": {
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e9f9540d298efbf902764a3f406dd7cb1b3af453",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 64.89.161.91:80 HTTP/1.0 Host: 64.89.161.91:80 Proxy-Authorization: Basic cm9vdDpoaWsxMjM0NQ==
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic cm9vdDpoaWsxMjM0NQ==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 108,
"payload_entropy": 5.19320958230145,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 205759,
"country": "US",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b62d6386c90989a029287e2bd0b7f2de",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpoaWsxMjM0NQ==\r\n\r\n",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpoaWsxMjM0NQ==\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpoaWsxMjM0NQ==",
"evidence": {
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpoaWsxMjM0NQ==\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpoaWsxMjM0NQ==",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "685ba45d654bf7ac6884c7ba13d35e196da1e5d2",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpoaWsxMjM0NQ==",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpoaWsxMjM0NQ==",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpoaWsxMjM0NQ==",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDpoaWsxMjM0NQ==",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 64.89.161.91:80 HTTP/1.0 Host: 64.89.161.91:80 Proxy-Authorization: Basic cm9vdDoxMjEyMTI=
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic cm9vdDoxMjEyMTI=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 104,
"payload_entropy": 5.138934402385254,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 205759,
"country": "US",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c78bedde236bf482e3b6ae5572d13b94",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDoxMjEyMTI=\r\n\r\n",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDoxMjEyMTI=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDoxMjEyMTI=",
"evidence": {
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDoxMjEyMTI=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDoxMjEyMTI=",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cf7eea783eb08a57b8e3ec991127c8de8ecc2c6e",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDoxMjEyMTI=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDoxMjEyMTI=",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDoxMjEyMTI=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic cm9vdDoxMjEyMTI=",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 64.89.161.91:80 HTTP/1.0 Host: 64.89.161.91:80 Proxy-Authorization: Basic bmFnaW9zOm5hZ2lvczAy
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.161.91:80 HTTP/1.0
Host: 64.89.161.91:80
Proxy-Authorization: Basic bmFnaW9zOm5hZ2lvczAy
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 108,
"payload_entropy": 5.208113660768459,
"port_category": "registered",
"org": "Ghosty Networks LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 205759,
"country": "US",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 205759,
"org": "Ghosty Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5abd300e6739e402f57ea2109dce9a37",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic bmFnaW9zOm5hZ2lvczAy\r\n\r\n",
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic bmFnaW9zOm5hZ2lvczAy\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic bmFnaW9zOm5hZ2lvczAy",
"evidence": {
"request_sample": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic bmFnaW9zOm5hZ2lvczAy\r\n\r\n",
"payload_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic bmFnaW9zOm5hZ2lvczAy",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cbfc4fafede1d932f832ac687f1077ba46c58eec",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic bmFnaW9zOm5hZ2lvczAy",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic bmFnaW9zOm5hZ2lvczAy",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic bmFnaW9zOm5hZ2lvczAy",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.161.91:80 HTTP\/1.0\r\nHost: 64.89.161.91:80\r\nProxy-Authorization: Basic bmFnaW9zOm5hZ2lvczAy",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|