|
|
TCP |
2122 · HTTP
|
http
|
Cross-site scripting
xss attack · via HTTP:2122 · (tentative d'exploit)
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) Apple…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2122
Chemin / cible
/
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 58
Confiance : Confiance 59 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.186 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:2122
AMP-Cache-Transform: google;v="1..8"
Connection: keep-alive
Accept: text/html,applicati
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:2122 AMP-Cache-Transform: google;v="1..8" Connection: keep-alive Accept: text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8 From: googlebot(at)googlebot.com User-Agent: Moz
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "a623c765a8ebd227b9863f98a26e7c988c4f6794",
"http_host_hash": "40f8e0fbe92368f8c65f21d00e7187c94f090ed0",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 493,
"payload_entropy": 5.485211037817523,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 2122,
"risk_waf": 96,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 58,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "a5046891fd344c9888d48cb94694043d7b9a610d",
"event_fingerprint": "2f8e3d6ed07177ad8c8a2031c5113215544a246a",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 58
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "40024f4d859edeb50bdb02b5d883a957",
"payload_hash": "cbde25477e5104b14fdba2b149395206",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 2122,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2122\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2122\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Moz",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2122\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2122\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Moz",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2122\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2ba76a43f02d6bd697b060bc59171c62d417dd72",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 2122,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2122\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"attack_vector": "xss attack \u00b7 via HTTP:2122 \u00b7 (tentative d'exploit)",
"target_port_label": "2122 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 58
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2122,
"protocol_emulated": null,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 2122,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "xss attack \u00b7 via HTTP:2122 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2122\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"target_port_label": "2122 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2122"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
91 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:91 · (tentative d'exploit) · → /robots.txt
|
Élevée
|
Moyen · 60
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /robots.txt UA Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
91
Chemin / cible
/robots.txt
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 60
Confiance : Confiance 50 % — 3 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:91
Connection: keep-alive
Accept: text/plain,text/html,*/*
User-Agent: Mozilla/5.0
Requête brute (extrait)
GET /robots.txt HTTP/1.1 Host: 62.3.50.33:91 Connection: keep-alive Accept: text/plain,text/html,*/* User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) Accept-Encoding: gzip, deflate, br
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "59c3d4f2509c82627f0eeb8e0e13ae1254eb4065",
"http_host_hash": "de210b0a489ef71c86be45fba5bfa22ea79eff7f",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 229,
"payload_entropy": 5.159052596741622,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 91,
"risk_waf": 84,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 60,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "c138ca86f9dece851f61d7a40c52247005042d83",
"event_fingerprint": "b40be62f001233a6b461cf500435bb726c30f81b",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 60
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "043937ea8abaea325dbde1020b1bdd9f",
"payload_hash": "803edcdbf31a110f5e2c0513ee4e7087",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 91,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:91\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:91\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\r\nAccept-Encoding: gzip, deflate, br\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:91\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:91\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\r\nAccept-Encoding: gzip, deflate, br\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:91\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1ed1ddd99315be717629a08c87d967d46e9f393e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"port": 91,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:91\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0",
"attack_vector": "ssrf attack \u00b7 via HTTP:91 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt",
"target_port_label": "91 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 60
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 91,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"port": 91,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:91 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt",
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:91\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0",
"target_port_label": "91 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "91"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
1471 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:1471 · (tentative d'exploit) · → /robots.txt
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /robots.txt UA Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
1471
Chemin / cible
/robots.txt
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 58
Confiance : Confiance 50 % — 3 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:1471
Connection: keep-alive
Accept: text/plain,text/html,*/*
User-Agent: Mozilla/5
Requête brute (extrait)
GET /robots.txt HTTP/1.1 Host: 62.3.50.33:1471 Connection: keep-alive Accept: text/plain,text/html,*/* User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) Accept-Encoding: gzip, deflate, br
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "59c3d4f2509c82627f0eeb8e0e13ae1254eb4065",
"http_host_hash": "529e31a9b0f9a3abd690f622d6bf2fab1a7217e1",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 231,
"payload_entropy": 5.179176473040274,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 1471,
"risk_waf": 84,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 58,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "46c22b8643454f8b9b72b400bf9757d5cd8c2ddc",
"event_fingerprint": "b22bff899b254cedb6c9d98f2b3ff104829485e6",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 58
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "043937ea8abaea325dbde1020b1bdd9f",
"payload_hash": "1e02fb2e8718c221232b7b86b46948a2",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 1471,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1471\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1471\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\r\nAccept-Encoding: gzip, deflate, br\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1471\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1471\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\r\nAccept-Encoding: gzip, deflate, br\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1471\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4b4e05c778825bca9ac903fe4d9dfdb3fbb0e56d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"port": 1471,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1471\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"attack_vector": "ssrf attack \u00b7 via HTTP:1471 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt",
"target_port_label": "1471 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 58
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1471,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"port": 1471,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:1471 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt",
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1471\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"target_port_label": "1471 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1471"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
1471 · HTTP
|
http
|
Cross-site scripting
xss attack · via HTTP:1471 · (tentative d'exploit)
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) Apple…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
1471
Chemin / cible
/
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 58
Confiance : Confiance 59 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.186 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:1471
AMP-Cache-Transform: google;v="1..8"
Connection: keep-alive
Accept: text/html,applicati
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:1471 AMP-Cache-Transform: google;v="1..8" Connection: keep-alive Accept: text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8 From: googlebot(at)googlebot.com User-Agent: Moz
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "a623c765a8ebd227b9863f98a26e7c988c4f6794",
"http_host_hash": "529e31a9b0f9a3abd690f622d6bf2fab1a7217e1",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 493,
"payload_entropy": 5.490191344291831,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 1471,
"risk_waf": 96,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 58,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9a0519a4b03708db258f599105c1fac72c596ddc",
"event_fingerprint": "51122ff8dec0c45ea2bd8087f8729eab7cde668b",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 58
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "40024f4d859edeb50bdb02b5d883a957",
"payload_hash": "5a9e4720e6f29e42fc35aed0796a7df9",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 1471,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1471\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1471\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Moz",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1471\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1471\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Moz",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1471\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0beaaa1bbff0558fbfad7e93cd28785e22389c2c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 1471,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1471\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"attack_vector": "xss attack \u00b7 via HTTP:1471 \u00b7 (tentative d'exploit)",
"target_port_label": "1471 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 58
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1471,
"protocol_emulated": null,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 1471,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "xss attack \u00b7 via HTTP:1471 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1471\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"target_port_label": "1471 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1471"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2003 · HTTP
|
http
|
Cross-site scripting
xss attack · via HTTP:2003 · (tentative d'exploit)
|
Élevée
|
Moyen · 59
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) Apple…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2003
Chemin / cible
/
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 59
Confiance : Confiance 59 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.186 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:2003
AMP-Cache-Transform: google;v="1..8"
Connection: keep-alive
Accept: text/html,applicati
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:2003 AMP-Cache-Transform: google;v="1..8" Connection: keep-alive Accept: text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8 From: googlebot(at)googlebot.com User-Agent: Moz
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "a623c765a8ebd227b9863f98a26e7c988c4f6794",
"http_host_hash": "2f46e012f48f3994cb49e5f2fd90210f17815f09",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 493,
"payload_entropy": 5.482436056977257,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 2003,
"risk_waf": 96,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 59,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "7eb1b35f9c4f88540771d1721bbb2d28d75796c4",
"event_fingerprint": "96e6fcd71c70e58c11372e25ed968b6b11344532",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 59
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "40024f4d859edeb50bdb02b5d883a957",
"payload_hash": "9cf6c323175c9324ab32d26ec379070e",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 2003,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2003\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2003\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Moz",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2003\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2003\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Moz",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2003\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fbf331e3eb10564001ea11544a33214fa7405e05",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 2003,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2003\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"attack_vector": "xss attack \u00b7 via HTTP:2003 \u00b7 (tentative d'exploit)",
"target_port_label": "2003 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 59
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2003,
"protocol_emulated": null,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 2003,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "xss attack \u00b7 via HTTP:2003 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2003\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"target_port_label": "2003 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2003"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4523 · HTTP
|
http
|
Cross-site scripting
xss attack · via HTTP:4523 · (tentative d'exploit)
|
Élevée
|
Moyen · 61
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) Apple…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
4523
Chemin / cible
/
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 61
Confiance : Confiance 59 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.186 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:4523
AMP-Cache-Transform: google;v="1..8"
Connection: keep-alive
Accept: text/html,applicati
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:4523 AMP-Cache-Transform: google;v="1..8" Connection: keep-alive Accept: text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8 From: googlebot(at)googlebot.com User-Agent: Moz
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "a623c765a8ebd227b9863f98a26e7c988c4f6794",
"http_host_hash": "2804c8c466e606f1151ab3f783c1e10a9b7dcd71",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 493,
"payload_entropy": 5.4920428137896335,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 4523,
"risk_waf": 96,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 61,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "fe09db807e84d6742a417ae07950a8eace38b499",
"event_fingerprint": "53c5231e74b8d7a25e0539d8cedb734685a8a2e8",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 61
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "40024f4d859edeb50bdb02b5d883a957",
"payload_hash": "ad8565aa30aa555f91f6207f7ee6e93c",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 4523,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4523\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4523\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Moz",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4523\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4523\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Moz",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4523\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "08612156a9536b413d502fa9a43201feb988f60f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 4523,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4523\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"attack_vector": "xss attack \u00b7 via HTTP:4523 \u00b7 (tentative d'exploit)",
"target_port_label": "4523 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 61
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 4523,
"protocol_emulated": null,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 4523,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "xss attack \u00b7 via HTTP:4523 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4523\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"target_port_label": "4523 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "4523"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4523 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:4523 · (tentative d'exploit) · → /robots.txt
|
Élevée
|
Moyen · 60
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /robots.txt UA Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
4523
Chemin / cible
/robots.txt
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 60
Confiance : Confiance 50 % — 3 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:4523
Connection: keep-alive
Accept: text/plain,text/html,*/*
User-Agent: Mozilla/5
Requête brute (extrait)
GET /robots.txt HTTP/1.1 Host: 62.3.50.33:4523 Connection: keep-alive Accept: text/plain,text/html,*/* User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) Accept-Encoding: gzip, deflate, br
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "59c3d4f2509c82627f0eeb8e0e13ae1254eb4065",
"http_host_hash": "2804c8c466e606f1151ab3f783c1e10a9b7dcd71",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 231,
"payload_entropy": 5.170950782434688,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 4523,
"risk_waf": 84,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 60,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "bc580be9f62c1b9b1fc82cd711336b23906858ed",
"event_fingerprint": "b6fb343d2015f1693d963cda6d683b59099dbefd",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 60
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "043937ea8abaea325dbde1020b1bdd9f",
"payload_hash": "425df8d012a4913f7452f4ca75a21c82",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 4523,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:4523\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:4523\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\r\nAccept-Encoding: gzip, deflate, br\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:4523\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:4523\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\r\nAccept-Encoding: gzip, deflate, br\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:4523\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "181019aeda3d16ac07a41d3385216be4eba5dbfb",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"port": 4523,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:4523\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"attack_vector": "ssrf attack \u00b7 via HTTP:4523 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt",
"target_port_label": "4523 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 60
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 4523,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"port": 4523,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:4523 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt",
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:4523\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"target_port_label": "4523 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "4523"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8189 · HTTP
|
http
|
Cross-site scripting
xss attack · via HTTP:8189 · (tentative d'exploit)
|
Élevée
|
Moyen · 57
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) Apple…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8189
Chemin / cible
/
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 57
Confiance : Confiance 59 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.186 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8189
AMP-Cache-Transform: google;v="1..8"
Connection: keep-alive
Accept: text/html,applicati
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8189 AMP-Cache-Transform: google;v="1..8" Connection: keep-alive Accept: text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8 From: googlebot(at)googlebot.com User-Agent: Moz
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "a623c765a8ebd227b9863f98a26e7c988c4f6794",
"http_host_hash": "0130f43e8ec8a74832b09b7d63e3a379fb426776",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 493,
"payload_entropy": 5.486205409005501,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 8189,
"risk_waf": 96,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.2,
"risk_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 57,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "011b651f85ec57bb7a808191d8e6b2cbdd27d2a3",
"event_fingerprint": "deb976de287aaa40feadd1bb786891b25204224d",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 57
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "40024f4d859edeb50bdb02b5d883a957",
"payload_hash": "ee96638d61c0b397062869629f19ccac",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8189,
"service": "http",
"service_name": "http",
"risk_score": 57
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8189\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8189\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Moz",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8189\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8189\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Moz",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8189\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b29202ed43c9dd38545538f240e54c49554f11c9",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 8189,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8189\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"attack_vector": "xss attack \u00b7 via HTTP:8189 \u00b7 (tentative d'exploit)",
"target_port_label": "8189 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 57
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 57,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8189,
"protocol_emulated": null,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 8189,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "xss attack \u00b7 via HTTP:8189 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8189\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"target_port_label": "8189 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8189"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8129 · HTTP
|
http
|
Cross-site scripting
xss attack · via HTTP:8129 · (tentative d'exploit)
|
Élevée
|
Moyen · 57
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) Apple…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8129
Chemin / cible
/
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 57
Confiance : Confiance 59 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.186 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8129
AMP-Cache-Transform: google;v="1..8"
Connection: keep-alive
Accept: text/html,applicati
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8129 AMP-Cache-Transform: google;v="1..8" Connection: keep-alive Accept: text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8 From: googlebot(at)googlebot.com User-Agent: Moz
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "a623c765a8ebd227b9863f98a26e7c988c4f6794",
"http_host_hash": "8ea326d4b6dea2b03b7fd40ee3657e13fdcbc724",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 493,
"payload_entropy": 5.487534054100943,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 8129,
"risk_waf": 96,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 57,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "5b142715516a9fe58af504a65a517f8ba3ff7cf9",
"event_fingerprint": "0866321f6a4013bf5ef38075c8388a2739001c27",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 57
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "40024f4d859edeb50bdb02b5d883a957",
"payload_hash": "9c7c6ca56ac128a5cff4f1a51d8cee20",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8129,
"service": "http",
"service_name": "http",
"risk_score": 57
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8129\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8129\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Moz",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8129\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8129\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Moz",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8129\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "73977d01a1bd76a18e2193b7464972c0fe67dd91",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 8129,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8129\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"attack_vector": "xss attack \u00b7 via HTTP:8129 \u00b7 (tentative d'exploit)",
"target_port_label": "8129 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 57
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 57,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8129,
"protocol_emulated": null,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 8129,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "xss attack \u00b7 via HTTP:8129 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8129\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"target_port_label": "8129 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8129"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Cross-site scripting
xss attack · via HTTP:3000 · (tentative d'exploit)
|
Élevée
|
Moyen · 61
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) Apple…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
69%
Corrélation +10
Risque capteur
Moyen
· 61
Confiance : Confiance 59 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.186 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:3000
AMP-Cache-Transform: google;v="1..8"
Connection: keep-alive
Accept: text/html,applicati
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:3000 AMP-Cache-Transform: google;v="1..8" Connection: keep-alive Accept: text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8 From: googlebot(at)googlebot.com User-Agent: Moz
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "a623c765a8ebd227b9863f98a26e7c988c4f6794",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 493,
"payload_entropy": 5.479505340064365,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 3000,
"risk_waf": 96,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 61,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "89e1cfbc9efcc944c0cfef77c198649bdc4d4082",
"event_fingerprint": "7fc19d22ffd8dad5e774a36c2166ff3cd4569919",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.69,
"classification_confidence": 0.69,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "40024f4d859edeb50bdb02b5d883a957",
"payload_hash": "179bb1b0f04a2e076d2a550da9109f2c",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Moz",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Moz",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0ecdb74114639cae44603d508a13c476fd9235b8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"attack_vector": "xss attack \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via HTTP \u2014 campagne \/24 (66.249.64.0\/24)",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "xss attack \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (66.249.64.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "66.249.64.0\/24",
"coordinated_ip_count": 4,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3000 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:3000 · (tentative d'exploit) · → /robots.txt
|
Élevée
|
Moyen · 60
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET /robots.txt UA Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/robots.txt
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 60
Confiance : Confiance 50 % — 3 tag(s) WAF
Protocole émulé
1
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:3000
Connection: keep-alive
Accept: text/plain,text/html,*/*
User-Agent: Mozilla/5
Requête brute (extrait)
GET /robots.txt HTTP/1.1 Host: 62.3.50.33:3000 Connection: keep-alive Accept: text/plain,text/html,*/* User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) Accept-Encoding: gzip, deflate, br
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2032340d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a557365722d6167656e743a202a0a446973616c6c6f77",
"emulator_response_len": 130,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "59c3d4f2509c82627f0eeb8e0e13ae1254eb4065",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 231,
"payload_entropy": 5.153202447066247,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 3000,
"risk_waf": 84,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 60,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "be719d4280f34aa05efbd9b510aed9ac0fc0d446",
"event_fingerprint": "de6dc458d09b67d14e35e73e8f363d0f1e3c652e",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.6,
"classification_confidence": 0.6,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 60,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "043937ea8abaea325dbde1020b1bdd9f",
"payload_hash": "41223ebccf7f346c8de3c65f61831b5d",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\r\nAccept-Encoding: gzip, deflate, br\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\r\nAccept-Encoding: gzip, deflate, br\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "001fd0d8a6118d5c74cc1e41d0a43165bab1f403",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"attack_vector": "ssrf attack \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 60 % \u2014 via HTTP \u2014 campagne \/24 (66.249.64.0\/24)",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 60,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt",
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (66.249.64.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "66.249.64.0\/24",
"coordinated_ip_count": 4,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
886 · HTTP
|
http
|
Cross-site scripting
xss attack · via HTTP:886 · (tentative d'exploit)
|
Élevée
|
Moyen · 59
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) Apple…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
886
Chemin / cible
/
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 59
Confiance : Confiance 59 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.186 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:886
AMP-Cache-Transform: google;v="1..8"
Connection: keep-alive
Accept: text/html,applicatio
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:886 AMP-Cache-Transform: google;v="1..8" Connection: keep-alive Accept: text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8 From: googlebot(at)googlebot.com User-Agent: Mozi
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "a623c765a8ebd227b9863f98a26e7c988c4f6794",
"http_host_hash": "f7ad0fd35706124f34818f8f101834a6a33bc8d7",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 492,
"payload_entropy": 5.483123312840572,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 886,
"risk_waf": 96,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 59,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9fdd6def886451129d9248375756eaece527f866",
"event_fingerprint": "04e3e726c4b7c86b74b52762410516f8e2583327",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 59
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "40024f4d859edeb50bdb02b5d883a957",
"payload_hash": "ffa01060b7deb6f14664c45a4cbb264a",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 886,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:886\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicatio",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:886\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Mozi",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:886\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicatio",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:886\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Mozi",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:886\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicatio",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "03dea39c8cdd49ccd3dffe5f616a8c22153c3d72",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 886,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:886\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicatio",
"attack_vector": "xss attack \u00b7 via HTTP:886 \u00b7 (tentative d'exploit)",
"target_port_label": "886 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 59
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 886,
"protocol_emulated": null,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 886,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "xss attack \u00b7 via HTTP:886 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:886\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicatio",
"target_port_label": "886 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "886"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
5120 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:5120 · (tentative d'exploit) · → /robots.txt
|
Élevée
|
Moyen · 56
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /robots.txt UA Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
5120
Chemin / cible
/robots.txt
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 56
Confiance : Confiance 50 % — 3 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:5120
Connection: keep-alive
Accept: text/plain,text/html,*/*
User-Agent: Mozilla/5
Requête brute (extrait)
GET /robots.txt HTTP/1.1 Host: 62.3.50.33:5120 Connection: keep-alive Accept: text/plain,text/html,*/* User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) Accept-Encoding: gzip, deflate, br
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "59c3d4f2509c82627f0eeb8e0e13ae1254eb4065",
"http_host_hash": "3870ec406110e49119856d1f309a9cef241f8f4c",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 231,
"payload_entropy": 5.159024862511902,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 5120,
"risk_waf": 84,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 56,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "832e27133723a181de9fe4a4bf44d5a392ab7117",
"event_fingerprint": "a9ddf22adad35dcd00f22a3c09e3577eecddcdcf",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 56
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "043937ea8abaea325dbde1020b1bdd9f",
"payload_hash": "84f01868e410932b7da042632dc7d46f",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 5120,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5120\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5120\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\r\nAccept-Encoding: gzip, deflate, br\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5120\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5120\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\r\nAccept-Encoding: gzip, deflate, br\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5120\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "959a6f6c5b9f5d059837273a6cd999945991d3cc",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"port": 5120,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5120\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"attack_vector": "ssrf attack \u00b7 via HTTP:5120 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt",
"target_port_label": "5120 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 56
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5120,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"port": 5120,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:5120 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt",
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:5120\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"target_port_label": "5120 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5120"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3168 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:3168 · (tentative d'exploit) · → /robots.txt
|
Élevée
|
Moyen · 56
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET /robots.txt UA Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3168
Chemin / cible
/robots.txt
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 56
Confiance : Confiance 50 % — 3 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:3168
Connection: keep-alive
Accept: text/plain,text/html,*/*
User-Agent: Mozilla/5
Requête brute (extrait)
GET /robots.txt HTTP/1.1 Host: 62.3.50.33:3168 Connection: keep-alive Accept: text/plain,text/html,*/* User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) Accept-Encoding: gzip, deflate, br
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "59c3d4f2509c82627f0eeb8e0e13ae1254eb4065",
"http_host_hash": "a11c269aa6b2f7b739bcf9b1a8e8fdb19aae86f0",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 231,
"payload_entropy": 5.17209650757101,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 3168,
"risk_waf": 84,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 56,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "e499047c3799abf337f2e02c1a49f2be2464273a",
"event_fingerprint": "ac2c19eb4850e042735003022201a7be2034d1e2",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.6,
"classification_confidence": 0.6,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 56,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "043937ea8abaea325dbde1020b1bdd9f",
"payload_hash": "2cf7aafaba1631a6c87006af9f7d171d",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 3168,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:3168\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:3168\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\r\nAccept-Encoding: gzip, deflate, br\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:3168\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:3168\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\r\nAccept-Encoding: gzip, deflate, br\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:3168\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fc68f9ea8dafb4a3ed3498722643618d05ad7780",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"port": 3168,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:3168\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"attack_vector": "ssrf attack \u00b7 via HTTP:3168 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt",
"target_port_label": "3168 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 60 % \u2014 via HTTP \u2014 campagne \/24 (66.249.64.0\/24)",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 56,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3168,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"port": 3168,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:3168 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt",
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:3168\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"target_port_label": "3168 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (66.249.64.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3168"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "66.249.64.0\/24",
"coordinated_ip_count": 5,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
5245 · HTTP
|
http
|
Cross-site scripting
xss attack · via HTTP:5245 · (tentative d'exploit)
|
Élevée
|
Moyen · 57
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) Apple…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
5245
Chemin / cible
/
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 57
Confiance : Confiance 59 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.186 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:5245
AMP-Cache-Transform: google;v="1..8"
Connection: keep-alive
Accept: text/html,applicati
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:5245 AMP-Cache-Transform: google;v="1..8" Connection: keep-alive Accept: text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8 From: googlebot(at)googlebot.com User-Agent: Moz
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "a623c765a8ebd227b9863f98a26e7c988c4f6794",
"http_host_hash": "dc28fc4fcf7cbe002d56c5bd9ea44345a7eb3411",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 493,
"payload_entropy": 5.492409567273171,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 5245,
"risk_waf": 96,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 57,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "6983c49482b16a847bf5f385c968f2c42a6ff32e",
"event_fingerprint": "49a9c6a3cb9533b5cba267887e4a02e7ed1a80d6",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 57
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "40024f4d859edeb50bdb02b5d883a957",
"payload_hash": "fd9f2df6cc0b56a8866764f8f7b65a62",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 5245,
"service": "http",
"service_name": "http",
"risk_score": 57
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5245\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5245\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Moz",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5245\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5245\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Moz",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5245\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fb00ffa4e5fe3cf6272d7c4ea9d38905b8f8760d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 5245,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5245\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"attack_vector": "xss attack \u00b7 via HTTP:5245 \u00b7 (tentative d'exploit)",
"target_port_label": "5245 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 57
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 57,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5245,
"protocol_emulated": null,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 5245,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "xss attack \u00b7 via HTTP:5245 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5245\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"target_port_label": "5245 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5245"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
1451 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:1451 · (tentative d'exploit) · → /robots.txt
|
Élevée
|
Moyen · 59
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /robots.txt UA Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
1451
Chemin / cible
/robots.txt
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 59
Confiance : Confiance 50 % — 3 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:1451
Connection: keep-alive
Accept: text/plain,text/html,*/*
User-Agent: Mozilla/5
Requête brute (extrait)
GET /robots.txt HTTP/1.1 Host: 62.3.50.33:1451 Connection: keep-alive Accept: text/plain,text/html,*/* User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) Accept-Encoding: gzip, deflate, br
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "59c3d4f2509c82627f0eeb8e0e13ae1254eb4065",
"http_host_hash": "41988dc8d5486319887e21795afc7117b1439a85",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 231,
"payload_entropy": 5.167250553117488,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 1451,
"risk_waf": 84,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 59,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "be4f09b3af60c61e3d7263dcea4eeed80fc2b897",
"event_fingerprint": "a29a62ac531793438dd6ae49bb8876ee5a9dfabf",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 59
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "043937ea8abaea325dbde1020b1bdd9f",
"payload_hash": "471ce5f147575dd49f7880ecc8dc3c2b",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 1451,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1451\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1451\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\r\nAccept-Encoding: gzip, deflate, br\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1451\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1451\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\r\nAccept-Encoding: gzip, deflate, br\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1451\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4a325a8d9a4e695a5028e53d0c7f18380fd8082d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"port": 1451,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1451\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"attack_vector": "ssrf attack \u00b7 via HTTP:1451 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt",
"target_port_label": "1451 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 59
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1451,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"port": 1451,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:1451 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt",
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:1451\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"target_port_label": "1451 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1451"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8879 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:8879 · (tentative d'exploit) · → /robots.txt
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /robots.txt UA Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8879
Chemin / cible
/robots.txt
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 58
Confiance : Confiance 50 % — 3 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:8879
Connection: keep-alive
Accept: text/plain,text/html,*/*
User-Agent: Mozilla/5
Requête brute (extrait)
GET /robots.txt HTTP/1.1 Host: 62.3.50.33:8879 Connection: keep-alive Accept: text/plain,text/html,*/* User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) Accept-Encoding: gzip, deflate, br
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "59c3d4f2509c82627f0eeb8e0e13ae1254eb4065",
"http_host_hash": "8768ef01ac68dbdc8fc9e5a2c654baed13fa565b",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 231,
"payload_entropy": 5.200192719673491,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 8879,
"risk_waf": 84,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 58,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a2101b7f77b830117e4f2606e51f197b2064d93d",
"event_fingerprint": "f31b902519a30a0c6dd11ff02b6b447fe9cdc4b0",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 58
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "043937ea8abaea325dbde1020b1bdd9f",
"payload_hash": "5d5374344927be50f07c2617290eddbc",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 8879,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8879\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8879\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\r\nAccept-Encoding: gzip, deflate, br\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8879\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8879\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\r\nAccept-Encoding: gzip, deflate, br\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8879\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "827f7016d36458416955cf337a73586bed0249e8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"port": 8879,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8879\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"attack_vector": "ssrf attack \u00b7 via HTTP:8879 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt",
"target_port_label": "8879 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 58
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8879,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"port": 8879,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:8879 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt",
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8879\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"target_port_label": "8879 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8879"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2122 · HTTP
|
http
|
Cross-site scripting
xss attack · via HTTP:2122 · (tentative d'exploit)
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) Apple…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2122
Chemin / cible
/
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 58
Confiance : Confiance 59 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.186 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:2122
AMP-Cache-Transform: google;v="1..8"
Connection: keep-alive
Accept: text/html,applicati
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:2122 AMP-Cache-Transform: google;v="1..8" Connection: keep-alive Accept: text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8 From: googlebot(at)googlebot.com User-Agent: Moz
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "a623c765a8ebd227b9863f98a26e7c988c4f6794",
"http_host_hash": "40f8e0fbe92368f8c65f21d00e7187c94f090ed0",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 493,
"payload_entropy": 5.485211037817523,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 2122,
"risk_waf": 96,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 58,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "a5046891fd344c9888d48cb94694043d7b9a610d",
"event_fingerprint": "2f8e3d6ed07177ad8c8a2031c5113215544a246a",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 58
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "40024f4d859edeb50bdb02b5d883a957",
"payload_hash": "cbde25477e5104b14fdba2b149395206",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 2122,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2122\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2122\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Moz",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2122\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2122\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Moz",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2122\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2ba76a43f02d6bd697b060bc59171c62d417dd72",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 2122,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2122\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"attack_vector": "xss attack \u00b7 via HTTP:2122 \u00b7 (tentative d'exploit)",
"target_port_label": "2122 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 58
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2122,
"protocol_emulated": null,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 2122,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "xss attack \u00b7 via HTTP:2122 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2122\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"target_port_label": "2122 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2122"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
91 · HTTP
|
http
|
Cross-site scripting
xss attack · via HTTP:91 · (tentative d'exploit)
|
Élevée
|
Moyen · 61
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) Apple…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
91
Chemin / cible
/
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 61
Confiance : Confiance 59 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.186 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:91
AMP-Cache-Transform: google;v="1..8"
Connection: keep-alive
Accept: text/html,application
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:91 AMP-Cache-Transform: google;v="1..8" Connection: keep-alive Accept: text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8 From: googlebot(at)googlebot.com User-Agent: Mozil
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "a623c765a8ebd227b9863f98a26e7c988c4f6794",
"http_host_hash": "de210b0a489ef71c86be45fba5bfa22ea79eff7f",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 491,
"payload_entropy": 5.481545060159356,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 91,
"risk_waf": 96,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 61,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4427389267d3eceb92aeb34f951192d7b1a2833d",
"event_fingerprint": "9102804e7dcc6eecf77a0f8e056c3b2b81d09339",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 61
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "40024f4d859edeb50bdb02b5d883a957",
"payload_hash": "b87656705c803aae4f42f4c2773626fe",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 91,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:91\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,application",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:91\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Mozil",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:91\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,application",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:91\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Mozil",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:91\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,application",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e5df3a6c0262ba3f8425113d6b8eb31c04d90c6f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 91,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:91\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,application",
"attack_vector": "xss attack \u00b7 via HTTP:91 \u00b7 (tentative d'exploit)",
"target_port_label": "91 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 61
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 91,
"protocol_emulated": null,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 91,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "xss attack \u00b7 via HTTP:91 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:91\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,application",
"target_port_label": "91 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "91"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
91 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:91 · (tentative d'exploit) · → /robots.txt
|
Élevée
|
Moyen · 60
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /robots.txt UA Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
91
Chemin / cible
/robots.txt
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 60
Confiance : Confiance 50 % — 3 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:91
Connection: keep-alive
Accept: text/plain,text/html,*/*
User-Agent: Mozilla/5.0
Requête brute (extrait)
GET /robots.txt HTTP/1.1 Host: 62.3.50.33:91 Connection: keep-alive Accept: text/plain,text/html,*/* User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) Accept-Encoding: gzip, deflate, br
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "59c3d4f2509c82627f0eeb8e0e13ae1254eb4065",
"http_host_hash": "de210b0a489ef71c86be45fba5bfa22ea79eff7f",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 229,
"payload_entropy": 5.159052596741622,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 91,
"risk_waf": 84,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 60,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "c138ca86f9dece851f61d7a40c52247005042d83",
"event_fingerprint": "b40be62f001233a6b461cf500435bb726c30f81b",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 60
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "043937ea8abaea325dbde1020b1bdd9f",
"payload_hash": "803edcdbf31a110f5e2c0513ee4e7087",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 91,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:91\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:91\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\r\nAccept-Encoding: gzip, deflate, br\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:91\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:91\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\r\nAccept-Encoding: gzip, deflate, br\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:91\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1ed1ddd99315be717629a08c87d967d46e9f393e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"port": 91,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:91\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0",
"attack_vector": "ssrf attack \u00b7 via HTTP:91 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt",
"target_port_label": "91 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 60
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 91,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"port": 91,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:91 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt",
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:91\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0",
"target_port_label": "91 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "91"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3053 · HTTP
|
http
|
Cross-site scripting
xss attack · via HTTP:3053 · (tentative d'exploit)
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) Apple…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3053
Chemin / cible
/
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 58
Confiance : Confiance 59 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.186 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:3053
AMP-Cache-Transform: google;v="1..8"
Connection: keep-alive
Accept: text/html,applicati
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:3053 AMP-Cache-Transform: google;v="1..8" Connection: keep-alive Accept: text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8 From: googlebot(at)googlebot.com User-Agent: Moz
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "a623c765a8ebd227b9863f98a26e7c988c4f6794",
"http_host_hash": "211f2071940268cad6a4c0a5e517a042117481aa",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 493,
"payload_entropy": 5.480291578528673,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 3053,
"risk_waf": 96,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 58,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "611dcd90547de2975bbad1869526e2b23be2a0f7",
"event_fingerprint": "1028c26c26797cff9dc16cdbcee88dbab52b4855",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 58
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "40024f4d859edeb50bdb02b5d883a957",
"payload_hash": "b32f1caa4f172ed0e100f5005e8d74ce",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3053,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3053\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3053\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Moz",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3053\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3053\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Moz",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3053\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "44e92cc9d6855701b3d9f32faa2c437d41bb3328",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 3053,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3053\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"attack_vector": "xss attack \u00b7 via HTTP:3053 \u00b7 (tentative d'exploit)",
"target_port_label": "3053 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 96,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 58
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3053,
"protocol_emulated": null,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 3053,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "xss attack \u00b7 via HTTP:3053 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3053\r\nAMP-Cache-Transform: google;v=\"1..8\"\r\nConnection: keep-alive\r\nAccept: text\/html,applicati",
"target_port_label": "3053 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3053"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
886 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:886 · (tentative d'exploit) · → /robots.txt
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /robots.txt UA Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
886
Chemin / cible
/robots.txt
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 58
Confiance : Confiance 50 % — 3 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:886
Connection: keep-alive
Accept: text/plain,text/html,*/*
User-Agent: Mozilla/5.
Requête brute (extrait)
GET /robots.txt HTTP/1.1 Host: 62.3.50.33:886 Connection: keep-alive Accept: text/plain,text/html,*/* User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) Accept-Encoding: gzip, deflate, br
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "59c3d4f2509c82627f0eeb8e0e13ae1254eb4065",
"http_host_hash": "f7ad0fd35706124f34818f8f101834a6a33bc8d7",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 230,
"payload_entropy": 5.173709571281192,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 886,
"risk_waf": 84,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 58,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "25b28eb1c4c2ead5dc686aaf00da0c87e21f33fb",
"event_fingerprint": "257cfb4b91c74a498e135d8d2f5ffa0d8b88e8cd",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 58
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "043937ea8abaea325dbde1020b1bdd9f",
"payload_hash": "d7ecd823ef9de4f41279a48cc0119429",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 886,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:886\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:886\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\r\nAccept-Encoding: gzip, deflate, br\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:886\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:886\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\r\nAccept-Encoding: gzip, deflate, br\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:886\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e5f60e675e7d8a9026b7321168af5f04f3d46eb4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"port": 886,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:886\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.",
"attack_vector": "ssrf attack \u00b7 via HTTP:886 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt",
"target_port_label": "886 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 58
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 886,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"port": 886,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:886 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt",
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:886\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.",
"target_port_label": "886 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "886"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8593 · HTTP
|
http
|
Cross-site scripting
xss attack · via HTTP:8593 · (tentative d'exploit)
|
Élevée
|
Moyen · 49
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) Apple…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8593
Chemin / cible
/
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 49
Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.186 Mobile Safari/537.36 (compatible; GoogleOther)
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8593
Connection: keep-alive
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8593 Connection: keep-alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 From: googlebot(at)googlebot.com User-Agent: Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.
Meta JSON brut
{
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "2e279a83d818ac3518e5579b370dbccc6b728ed7",
"http_host_hash": "2935da9cc0d29194c2f9bb855aca8fa9dd2c16f2",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 387,
"payload_entropy": 5.480259323270582,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 8593,
"risk_waf": 72,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 72,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 49,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "fbd30ac3446e4c0dc72543b411432601b635f6f6",
"event_fingerprint": "10968755056f42e521781d2d5446cb79907e8124",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 72,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 49
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c54e0ee4e99661347dea6a08b1a3f6ba",
"payload_hash": "ba83d82d36863bc6e9a5f3970606ff27",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8593,
"service": "http",
"service_name": "http",
"risk_score": 49
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8593\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; GoogleOther)",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8593\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8593\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; GoogleOther)",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8593\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8593\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ddb6db6a362db0ed295a9e2cae0cffaac22721b0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 8593,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8593\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*",
"attack_vector": "xss attack \u00b7 via HTTP:8593 \u00b7 (tentative d'exploit)",
"target_port_label": "8593 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 72,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 49
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 49,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8593,
"protocol_emulated": null,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 8593,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "xss attack \u00b7 via HTTP:8593 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8593\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*",
"target_port_label": "8593 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8593"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8888 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:8888 · (tentative d'exploit) · → /robots.txt
|
Élevée
|
Moyen · 60
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /robots.txt UA Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8888
Chemin / cible
/robots.txt
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 60
Confiance : Confiance 50 % — 3 tag(s) WAF
Protocole émulé
1
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
HTTP alt 8888 probe
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:8888
Connection: keep-alive
Accept: text/plain,text/html,*/*
User-Agent: Mozilla/5
Requête brute (extrait)
GET /robots.txt HTTP/1.1 Host: 62.3.50.33:8888 Connection: keep-alive Accept: text/plain,text/html,*/* User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) Accept-Encoding: gzip, deflate, br
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2032340d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a557365722d6167656e743a202a0a446973616c6c6f77",
"emulator_response_len": 130,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "59c3d4f2509c82627f0eeb8e0e13ae1254eb4065",
"http_host_hash": "25a58e7d7f0ed40aadf0d51b038172ea9ccc8435",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 231,
"payload_entropy": 5.174218693699465,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 8888,
"risk_waf": 84,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 60,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9f2dd68e9934f4ee309d179bcccc726b630af9ec",
"event_fingerprint": "ca9a1f3d545fc228c5a88f81bd40fd6724ae2b03",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103",
"pat-0599"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0103",
"pat-0599"
],
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 60
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "043937ea8abaea325dbde1020b1bdd9f",
"payload_hash": "4427550ff88236dceed2c2f8912fdd93",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 8888,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\r\nAccept-Encoding: gzip, deflate, br\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\r\nAccept-Encoding: gzip, deflate, br\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "af0a6d3c0d3e7fff05cef9a2ecf20ecd9cb0411d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"attack_vector": "ssrf attack \u00b7 via HTTP:8888 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 60
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8888,
"protocol_emulated": true,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:8888 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt",
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
6363 · HTTP
|
http
|
Cross-site scripting
xss attack · via HTTP:6363 · (tentative d'exploit)
|
Élevée
|
Moyen · 49
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) Apple…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
6363
Chemin / cible
/
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 49
Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.186 Mobile Safari/537.36 (compatible; GoogleOther)
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:6363
Connection: keep-alive
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:6363 Connection: keep-alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 From: googlebot(at)googlebot.com User-Agent: Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.
Meta JSON brut
{
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "2e279a83d818ac3518e5579b370dbccc6b728ed7",
"http_host_hash": "0918c21bb05d1be3c258b6d1b83e4dae58feb6f5",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 387,
"payload_entropy": 5.473981650033189,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 6363,
"risk_waf": 72,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 72,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 49,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "3cc969e377ea4ce117c764b05737812df921b45d",
"event_fingerprint": "6c3ab34a481b25cb5561d18a9c830168e3cb5887",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 72,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 49
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c54e0ee4e99661347dea6a08b1a3f6ba",
"payload_hash": "d55cf74aa08be1c0b9df9a1b099b89d1",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 6363,
"service": "http",
"service_name": "http",
"risk_score": 49
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6363\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; GoogleOther)",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6363\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6363\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; GoogleOther)",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6363\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6363\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c16dc4ba14a2726992948e77b02911ab548e4028",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 6363,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6363\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*",
"attack_vector": "xss attack \u00b7 via HTTP:6363 \u00b7 (tentative d'exploit)",
"target_port_label": "6363 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 72,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 49
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 49,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 6363,
"protocol_emulated": null,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 6363,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "xss attack \u00b7 via HTTP:6363 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6363\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*",
"target_port_label": "6363 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "6363"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8915 · HTTP
|
http
|
Cross-site scripting
xss attack · via HTTP:8915 · (tentative d'exploit)
|
Élevée
|
Moyen · 51
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) Apple…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8915
Chemin / cible
/
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
69%
Corrélation +10
Risque capteur
Moyen
· 51
Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.186 Mobile Safari/537.36 (compatible; GoogleOther)
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8915
Connection: keep-alive
Accept: text/html,application/xhtml+xml,application/signed-exchan
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8915 Connection: keep-alive Accept: text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8 From: googlebot(at)googlebot.com User-Agent: Mozilla/5.0 (Linux; Android 6.0.1; Nexus
Meta JSON brut
{
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "2e279a83d818ac3518e5579b370dbccc6b728ed7",
"http_host_hash": "34c7fbcbb0c1c94cd9d24ea03b7d35d10c3510c1",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 420,
"payload_entropy": 5.471695064864877,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 8915,
"risk_waf": 72,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 72,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 51,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d6376d5f89f9f8ebbfae388343f1b85086f93671",
"event_fingerprint": "86229f7a8ffe606b92ade6f1d9230418cb250cfc",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.69,
"classification_confidence": 0.69,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 72,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 51,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c54e0ee4e99661347dea6a08b1a3f6ba",
"payload_hash": "b59226624555eac05be6cb45d790312b",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8915,
"service": "http",
"service_name": "http",
"risk_score": 51
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8915\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchan",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; GoogleOther)",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8915\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0.1; Nexus ",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8915\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchan",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; GoogleOther)",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8915\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0.1; Nexus ",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8915\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchan",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8bca24c0340ff201d5e049363294380cc65cee82",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 8915,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8915\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchan",
"attack_vector": "xss attack \u00b7 via HTTP:8915 \u00b7 (tentative d'exploit)",
"target_port_label": "8915 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via HTTP \u2014 campagne \/24 (66.249.64.0\/24)",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 72,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 51,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 51,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8915,
"protocol_emulated": null,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 8915,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "xss attack \u00b7 via HTTP:8915 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8915\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchan",
"target_port_label": "8915 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (66.249.64.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8915"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "66.249.64.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2570 · HTTP
|
http
|
Cross-site scripting
xss attack · via HTTP:2570 · (tentative d'exploit)
|
Élevée
|
Moyen · 52
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) Apple…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2570
Chemin / cible
/
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
69%
Corrélation +10
Risque capteur
Moyen
· 52
Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.186 Mobile Safari/537.36 (compatible; GoogleOther)
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:2570
Connection: keep-alive
Accept: text/html,application/xhtml+xml,application/signed-exchan
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:2570 Connection: keep-alive Accept: text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8 From: googlebot(at)googlebot.com User-Agent: Mozilla/5.0 (Linux; Android 6.0.1; Nexus
Meta JSON brut
{
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "2e279a83d818ac3518e5579b370dbccc6b728ed7",
"http_host_hash": "9b8477f956aa1f7e139f7d5cdb3e09ce07aee270",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 420,
"payload_entropy": 5.470334745645541,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 2570,
"risk_waf": 72,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 72,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 52,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b3f366e32540a7532e43937065da000417d083fd",
"event_fingerprint": "48af663b5b42a36ff4d601f28afcb5d00d85f243",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.69,
"classification_confidence": 0.69,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 72,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c54e0ee4e99661347dea6a08b1a3f6ba",
"payload_hash": "553706e52e87e7b5877d1ce4ca956d24",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 2570,
"service": "http",
"service_name": "http",
"risk_score": 52
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2570\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchan",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; GoogleOther)",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2570\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0.1; Nexus ",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2570\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchan",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; GoogleOther)",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2570\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0.1; Nexus ",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2570\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchan",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3c2c02a1f9d3c1124b50195ef362d592eb281ca7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 2570,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2570\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchan",
"attack_vector": "xss attack \u00b7 via HTTP:2570 \u00b7 (tentative d'exploit)",
"target_port_label": "2570 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via HTTP \u2014 campagne \/24 (66.249.64.0\/24)",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 72,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2570,
"protocol_emulated": null,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 2570,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "xss attack \u00b7 via HTTP:2570 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2570\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchan",
"target_port_label": "2570 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (66.249.64.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2570"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "66.249.64.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8825 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:8825 · (tentative d'exploit) · → /robots.txt
|
Élevée
|
Moyen · 59
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /robots.txt UA Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8825
Chemin / cible
/robots.txt
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 59
Confiance : Confiance 50 % — 3 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:8825
Connection: keep-alive
Accept: text/plain,text/html,*/*
User-Agent: Mozilla/5
Requête brute (extrait)
GET /robots.txt HTTP/1.1 Host: 62.3.50.33:8825 Connection: keep-alive Accept: text/plain,text/html,*/* User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) Accept-Encoding: gzip, deflate, br
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "59c3d4f2509c82627f0eeb8e0e13ae1254eb4065",
"http_host_hash": "e44723cbdc26da78fec2cc631e5ec95b6a9890df",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 231,
"payload_entropy": 5.17634087982792,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 8825,
"risk_waf": 84,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 59,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "712382763ad97a7fc72cdccf2408aeec92b629bd",
"event_fingerprint": "d8b2a76dd365a1c744e185bc66b9df12af388216",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 59
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "043937ea8abaea325dbde1020b1bdd9f",
"payload_hash": "24c31013729801eed95f1e5c31d35a71",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 8825,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8825\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8825\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\r\nAccept-Encoding: gzip, deflate, br\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8825\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8825\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\r\nAccept-Encoding: gzip, deflate, br\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8825\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9cc639e32b0d0a0c8797b433a4f01057f631337a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"port": 8825,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8825\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"attack_vector": "ssrf attack \u00b7 via HTTP:8825 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt",
"target_port_label": "8825 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 59
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8825,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"port": 8825,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:8825 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt",
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8825\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"target_port_label": "8825 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8825"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8866 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:8866 · (tentative d'exploit) · → /robots.txt
|
Élevée
|
Moyen · 55
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /robots.txt UA Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8866
Chemin / cible
/robots.txt
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 55
Confiance : Confiance 50 % — 3 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:8866
Connection: keep-alive
Accept: text/plain,text/html,*/*
User-Agent: Mozilla/5
Requête brute (extrait)
GET /robots.txt HTTP/1.1 Host: 62.3.50.33:8866 Connection: keep-alive Accept: text/plain,text/html,*/* User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) Accept-Encoding: gzip, deflate, br
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "59c3d4f2509c82627f0eeb8e0e13ae1254eb4065",
"http_host_hash": "805a5b456361bd761564d84d0e734179187ffcc7",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 231,
"payload_entropy": 5.179608791092696,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 8866,
"risk_waf": 84,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 55,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "f486603b0068f96e1f317bedfcf191be83d1c365",
"event_fingerprint": "e77f98b134452db9ace73f91c19ebbf493bae8ea",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 55
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "043937ea8abaea325dbde1020b1bdd9f",
"payload_hash": "78b5abd4ab526d0e5b10ae67d546c27f",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 8866,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8866\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8866\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\r\nAccept-Encoding: gzip, deflate, br\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8866\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8866\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\r\nAccept-Encoding: gzip, deflate, br\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8866\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2ef5aac4aef19260f5a41f9012c0908003b16de7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"port": 8866,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8866\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"attack_vector": "ssrf attack \u00b7 via HTTP:8866 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt",
"target_port_label": "8866 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 55
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8866,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"port": 8866,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:8866 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt",
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:8866\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"target_port_label": "8866 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8866"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8866 · HTTP
|
http
|
Cross-site scripting
xss attack · via HTTP:8866 · (tentative d'exploit)
|
Élevée
|
Moyen · 48
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) Apple…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8866
Chemin / cible
/
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 48
Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.186 Mobile Safari/537.36 (compatible; GoogleOther)
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8866
Connection: keep-alive
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8866 Connection: keep-alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 From: googlebot(at)googlebot.com User-Agent: Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.
Meta JSON brut
{
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "2e279a83d818ac3518e5579b370dbccc6b728ed7",
"http_host_hash": "805a5b456361bd761564d84d0e734179187ffcc7",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 387,
"payload_entropy": 5.479209266535268,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 8866,
"risk_waf": 72,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 72,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 48,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12c820f3813f2ca68336812e48dbf469fcc5269b",
"event_fingerprint": "d1d46b863531dece3091dbf117a58a228f7ad7f6",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 72,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 48
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c54e0ee4e99661347dea6a08b1a3f6ba",
"payload_hash": "3a028afebdf88f1e055338cdb7e92d0f",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8866,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8866\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; GoogleOther)",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8866\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8866\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; GoogleOther)",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8866\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8866\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a710128eeb015a42e5dc0dde7e52d4538eb9c322",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 8866,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8866\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*",
"attack_vector": "xss attack \u00b7 via HTTP:8866 \u00b7 (tentative d'exploit)",
"target_port_label": "8866 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 72,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 48
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8866,
"protocol_emulated": null,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 8866,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "xss attack \u00b7 via HTTP:8866 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8866\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*",
"target_port_label": "8866 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8866"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2985 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:2985 · (tentative d'exploit) · → /robots.txt
|
Élevée
|
Moyen · 57
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /robots.txt UA Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2985
Chemin / cible
/robots.txt
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 57
Confiance : Confiance 50 % — 3 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Règles WAF
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:2985
Connection: keep-alive
Accept: text/plain,text/html,*/*
User-Agent: Mozilla/5
Requête brute (extrait)
GET /robots.txt HTTP/1.1 Host: 62.3.50.33:2985 Connection: keep-alive Accept: text/plain,text/html,*/* User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) Accept-Encoding: gzip, deflate, br
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "59c3d4f2509c82627f0eeb8e0e13ae1254eb4065",
"http_host_hash": "25c38a02ad188d0ebd8baa8f60fc262bc50f37fe",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 231,
"payload_entropy": 5.184998888485929,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 2985,
"risk_waf": 84,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 57,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a6397fbad0106182ce90401426a3fb97d0f0d3ce",
"event_fingerprint": "fa160ef1097d1e789d05438a0e3998dbc8136b55",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 57
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "043937ea8abaea325dbde1020b1bdd9f",
"payload_hash": "35709842c765984595833b66d13d0991",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 2985,
"service": "http",
"service_name": "http",
"risk_score": 57
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2985\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2985\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\r\nAccept-Encoding: gzip, deflate, br\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2985\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2985\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)\r\nAccept-Encoding: gzip, deflate, br\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2985\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "602eee79d97ded721db163bac62d4fe030412c20",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"port": 2985,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2985\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"attack_vector": "ssrf attack \u00b7 via HTTP:2985 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt",
"target_port_label": "2985 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 57
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 57,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2985,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Googlebot\/2.1; +http:\/\/www.google.com\/bot.html)",
"port": 2985,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:2985 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt",
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2985\r\nConnection: keep-alive\r\nAccept: text\/plain,text\/html,*\/*\r\nUser-Agent: Mozilla\/5",
"target_port_label": "2985 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2985"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3104 · HTTP
|
http
|
Cross-site scripting
xss attack · via HTTP:3104 · (tentative d'exploit)
|
Élevée
|
Moyen · 48
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) Apple…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3104
Chemin / cible
/
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 48
Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.186 Mobile Safari/537.36 (compatible; GoogleOther)
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:3104
Connection: keep-alive
Accept: text/html,application/xhtml+xml,application/signed-exchan
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:3104 Connection: keep-alive Accept: text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8 From: googlebot(at)googlebot.com User-Agent: Mozilla/5.0 (Linux; Android 6.0.1; Nexus
Meta JSON brut
{
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "2e279a83d818ac3518e5579b370dbccc6b728ed7",
"http_host_hash": "0e883a0e1383c84b8ce3bb0cba4adeba223e29aa",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 420,
"payload_entropy": 5.474704276511302,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 3104,
"risk_waf": 72,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 72,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 48,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "90191646cd3224649d9ca0d6f51c521adee50092",
"event_fingerprint": "dd65ef3674e1b08c1b796e1048ad80c5209c8799",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 72,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 48
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c54e0ee4e99661347dea6a08b1a3f6ba",
"payload_hash": "044e995b83c9fa9459273bb041a2d4bb",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3104,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3104\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchan",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; GoogleOther)",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3104\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0.1; Nexus ",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3104\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchan",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; GoogleOther)",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3104\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0.1; Nexus ",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3104\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchan",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "499f1bf41e6b0179fa15ee095d98c591374a2cb5",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 3104,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3104\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchan",
"attack_vector": "xss attack \u00b7 via HTTP:3104 \u00b7 (tentative d'exploit)",
"target_port_label": "3104 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 72,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 48
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3104,
"protocol_emulated": null,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 3104,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "xss attack \u00b7 via HTTP:3104 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3104\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchan",
"target_port_label": "3104 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3104"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8583 · HTTP
|
http
|
Cross-site scripting
xss attack · via HTTP:8583 · (tentative d'exploit)
|
Élevée
|
Moyen · 52
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) Apple…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8583
Chemin / cible
/
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
69%
Corrélation +10
Risque capteur
Moyen
· 52
Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.186 Mobile Safari/537.36 (compatible; GoogleOther)
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8583
Connection: keep-alive
Accept: text/html,application/xhtml+xml,application/signed-exchan
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8583 Connection: keep-alive Accept: text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8 From: googlebot(at)googlebot.com User-Agent: Mozilla/5.0 (Linux; Android 6.0.1; Nexus
Meta JSON brut
{
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "2e279a83d818ac3518e5579b370dbccc6b728ed7",
"http_host_hash": "a7620ee02dd734b5d1605d459b0268f06ca34177",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 420,
"payload_entropy": 5.468737044543024,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 15169,
"country": "US",
"dst_port": 8583,
"risk_waf": 72,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 72,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 52,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "e58a3fd86be69fb3d2ce3611e07320d2e6313a1b",
"event_fingerprint": "0c04347e5cdbb47d30bfa00ee20d2b85a07ac4cd",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.69,
"classification_confidence": 0.69,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 72,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 15169,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c54e0ee4e99661347dea6a08b1a3f6ba",
"payload_hash": "3ba08240fe326e997c937ed7bc978df4",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8583,
"service": "http",
"service_name": "http",
"risk_score": 52
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8583\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchan",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; GoogleOther)",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8583\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0.1; Nexus ",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8583\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchan",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 Mobile Safari\/537.36 (compatible; GoogleOther)",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8583\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchange;v=b3,application\/xml;q=0.9,*\/*;q=0.8\r\nFrom: googlebot(at)googlebot.com\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0.1; Nexus ",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8583\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchan",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ccf61d6b5766c0f9829ddee4464570ba5755f512",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 8583,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8583\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchan",
"attack_vector": "xss attack \u00b7 via HTTP:8583 \u00b7 (tentative d'exploit)",
"target_port_label": "8583 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via HTTP \u2014 campagne \/24 (66.249.64.0\/24)",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 72,
"classification": 68,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8583,
"protocol_emulated": null,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; Nexus 5X Build\/MMB29P) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/150.0.7871.186 \u2026",
"port": 8583,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "xss attack \u00b7 via HTTP:8583 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8583\r\nConnection: keep-alive\r\nAccept: text\/html,application\/xhtml+xml,application\/signed-exchan",
"target_port_label": "8583 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (66.249.64.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8583"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "66.249.64.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
|