|
|
TCP |
8001 · HTTP
|
http
|
Sonde port 8001/TCP
port 8001 tcp · via HTTP:8001 · (sonde / probe) · → /api/config
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /api/config UA python-requests/2.34.2
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950468:nosqli-3
950600:k8s-api
scanner-ua
anomaly:scanner-ua
Cible HTTP
GET
/api/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8001
Chemin / cible
/api/config
Preuve honeypot — Sonde port 8001/TCP
Connexion détectée sur le port 8001 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_8001_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 42
Confiance : Confiance 50 % — Classification nommée non retenue — preuves insuffisantes · 3 tag(s) WAF
Protocole émulé
1
Signaux
Upstream
Waf Score
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /api/config HTTP/1.1
User-Agent
python-requests/2.34.2
Règles WAF
nosqli-3
k8s-api
scanner-ua
Payload (extrait)
GET /api/config HTTP/1.1
Host: 62.3.50.33:8001
User-Agent: python-requests/2.34.2
Accept-Encoding: gzip, deflate
Accept: */*
Requête brute (extrait)
GET /api/config HTTP/1.1 Host: 62.3.50.33:8001 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "39629e9324a6a8ca42f0eb616186476a68e5066b",
"http_host_hash": "29d114ae8a3567c5f1863f5bd79c5d398a432fe8",
"http_target_hash": "3c5fcdb0fafcc174d1f9556c1cd63005351cd3bc",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 156,
"payload_entropy": 5.120903219625611,
"port_category": "registered",
"org": "Baykov Ilya Sergeevich",
"service": "http",
"app_proto": "http",
"asn": 41745,
"country": "FR",
"dst_port": 8001,
"risk_waf": 60,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 60,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 42,
"tag_count": 7,
"anomaly_count": 1,
"campaign_key": "8cae6c967c152f341546609fe64f9834317f1c1d",
"event_fingerprint": "35a673177ca871b6d9f178ec0056c5e8a1e5e787",
"classification_reason": "Type \u00ab port_8001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 60,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 42
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 41745,
"org": "Baykov Ilya Sergeevich",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8828b706bdd52f2a93e84929e06411ae",
"payload_hash": "a8ae2f4e2b69d5759605eb57c0847723",
"path_pattern_hash": "3ff24867cd794d601de4aacbf3343c91"
},
"target_context": {
"dst_port": 8001,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/api\/config HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*",
"method": "GET",
"path": "\/api\/config",
"user_agent": "python-requests\/2.34.2",
"waf_tags": [
"950468:nosqli-3",
"950600:k8s-api",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"k8s-api",
"scanner-ua"
],
"request_line": "GET \/api\/config HTTP\/1.1",
"request_sample": "GET \/api\/config HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/api\/config HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*",
"evidence": {
"method": "GET",
"path": "\/api\/config",
"user_agent": "python-requests\/2.34.2",
"waf_tags": [
"950468:nosqli-3",
"950600:k8s-api",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"k8s-api",
"scanner-ua"
],
"request_line": "GET \/api\/config HTTP\/1.1",
"request_sample": "GET \/api\/config HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/api\/config HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*",
"classification_reason": "Type \u00ab port_8001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3cc73571a6a1d7c5146cf7f3bdd04f4190461352",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/config",
"request_line": "GET \/api\/config HTTP\/1.1",
"http_user_agent": "python-requests\/2.34.2",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/config HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*",
"attack_vector": "port 8001 tcp \u00b7 via HTTP:8001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/api\/config",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_8001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_8001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 60,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 42
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8001,
"protocol_emulated": true,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/config",
"request_line": "GET \/api\/config HTTP\/1.1",
"http_user_agent": "python-requests\/2.34.2",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 8001 tcp \u00b7 via HTTP:8001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/api\/config",
"evidence_snippet": "GET \/api\/config HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 60 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"950600:k8s-api",
"anomaly:scanner-ua",
"http_probe_api",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
8001 · HTTP
|
http
|
Sonde port 8001/TCP
port 8001 tcp · via HTTP:8001 · (sonde / probe) · → /api/settings
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /api/settings UA python-requests/2.34.2
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950468:nosqli-3
950600:k8s-api
scanner-ua
anomaly:scanner-ua
Cible HTTP
GET
/api/settings
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8001
Chemin / cible
/api/settings
Preuve honeypot — Sonde port 8001/TCP
Connexion détectée sur le port 8001 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_8001_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 42
Confiance : Confiance 50 % — Classification nommée non retenue — preuves insuffisantes · 3 tag(s) WAF
Protocole émulé
1
Signaux
Upstream
Waf Score
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /api/settings HTTP/1.1
User-Agent
python-requests/2.34.2
Règles WAF
nosqli-3
k8s-api
scanner-ua
Payload (extrait)
GET /api/settings HTTP/1.1
Host: 62.3.50.33:8001
User-Agent: python-requests/2.34.2
Accept-Encoding: gzip, deflate
Accept: *
Requête brute (extrait)
GET /api/settings HTTP/1.1 Host: 62.3.50.33:8001 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "39629e9324a6a8ca42f0eb616186476a68e5066b",
"http_host_hash": "29d114ae8a3567c5f1863f5bd79c5d398a432fe8",
"http_target_hash": "e8f9f693bfd4e746949fc40b20697455a0237f2e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 158,
"payload_entropy": 5.0921654179155205,
"port_category": "registered",
"org": "Baykov Ilya Sergeevich",
"service": "http",
"app_proto": "http",
"asn": 41745,
"country": "FR",
"dst_port": 8001,
"risk_waf": 60,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 60,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 42,
"tag_count": 7,
"anomaly_count": 1,
"campaign_key": "8cae6c967c152f341546609fe64f9834317f1c1d",
"event_fingerprint": "dac156b158e25b707b3d4c2f5feb886139704151",
"classification_reason": "Type \u00ab port_8001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 60,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 42
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 41745,
"org": "Baykov Ilya Sergeevich",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8828b706bdd52f2a93e84929e06411ae",
"payload_hash": "3cce29efee77c1e0661f5f0447ee33ec",
"path_pattern_hash": "516d279ce4f4fa3aeff988f417de0090"
},
"target_context": {
"dst_port": 8001,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/api\/settings HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *",
"method": "GET",
"path": "\/api\/settings",
"user_agent": "python-requests\/2.34.2",
"waf_tags": [
"950468:nosqli-3",
"950600:k8s-api",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"k8s-api",
"scanner-ua"
],
"request_line": "GET \/api\/settings HTTP\/1.1",
"request_sample": "GET \/api\/settings HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/api\/settings HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *",
"evidence": {
"method": "GET",
"path": "\/api\/settings",
"user_agent": "python-requests\/2.34.2",
"waf_tags": [
"950468:nosqli-3",
"950600:k8s-api",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"k8s-api",
"scanner-ua"
],
"request_line": "GET \/api\/settings HTTP\/1.1",
"request_sample": "GET \/api\/settings HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/api\/settings HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *",
"classification_reason": "Type \u00ab port_8001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "eb9a62a05fa0b7803764345a07ea830d8c6c9029",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/settings",
"request_line": "GET \/api\/settings HTTP\/1.1",
"http_user_agent": "python-requests\/2.34.2",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/settings HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *",
"attack_vector": "port 8001 tcp \u00b7 via HTTP:8001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/api\/settings",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_8001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_8001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 60,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 42
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8001,
"protocol_emulated": true,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/settings",
"request_line": "GET \/api\/settings HTTP\/1.1",
"http_user_agent": "python-requests\/2.34.2",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 8001 tcp \u00b7 via HTTP:8001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/api\/settings",
"evidence_snippet": "GET \/api\/settings HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 60 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"950600:k8s-api",
"anomaly:scanner-ua",
"http_probe_api",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
8001 · HTTP
|
http
|
Sonde fichier credential / clé
credential file probe · via HTTP:8001 · (tentative d'exploit) · → /.aws/credentials
|
Élevée
|
Moyen · 52
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.aws/credentials UA python-requests/2.34.2
Émulateur
HTTP
WAF
9
Recommandation
Investiguer
Tags
950468:nosqli-3
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
GET
/.aws/credentials
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8001
Chemin / cible
/.aws/credentials
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « nosqli-3 » · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 52
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-credential-file
pat-0468
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred AWS credentials file
Ligne de requête
GET /.aws/credentials HTTP/1.1
User-Agent
python-requests/2.34.2
Règles WAF
nosqli-3
scanner-ua
Payload (extrait)
GET /.aws/credentials HTTP/1.1
Host: 62.3.50.33:8001
User-Agent: python-requests/2.34.2
Accept-Encoding: gzip, deflate
Accep
Requête brute (extrait)
GET /.aws/credentials HTTP/1.1 Host: 62.3.50.33:8001 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "aws\/credentials",
"http_ua_hash": "39629e9324a6a8ca42f0eb616186476a68e5066b",
"http_host_hash": "29d114ae8a3567c5f1863f5bd79c5d398a432fe8",
"http_target_hash": "ace4c5fcde31b7bd909f97bc14a4a98472286e7e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 162,
"payload_entropy": 5.125712156185409,
"port_category": "registered",
"org": "Baykov Ilya Sergeevich",
"service": "http",
"app_proto": "http",
"asn": 41745,
"country": "FR",
"dst_port": 8001,
"risk_waf": 44,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 2.2,
"risk_breakdown": {
"waf": 44,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 52,
"tag_count": 5,
"anomaly_count": 1,
"campaign_key": "05bc371867ad76e4930e109339fb558936586850",
"event_fingerprint": "016267bc4ba6c522ad09faf26f51788539ee21cc",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"SIGMA-web-credential-file",
"pat-0468",
"INT-upstream"
],
"kb_rule_ids": [
"SIGMA-web-credential-file",
"pat-0468",
"INT-upstream"
],
"matched_patterns": [
"pat-0468"
],
"matched_pattern_names": [
"Cred AWS credentials file"
],
"pattern_ids": [
"pat-0468"
],
"confidence_breakdown": {
"waf": 44,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 52
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 41745,
"org": "Baykov Ilya Sergeevich",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8828b706bdd52f2a93e84929e06411ae",
"payload_hash": "1403399cd8e2827aed036d230e04bd1e",
"path_pattern_hash": "02b5f84eeada8b8c7cddae6a529f493a"
},
"target_context": {
"dst_port": 8001,
"service": "http",
"service_name": "http",
"risk_score": 52
},
"payload_preview": "GET \/.aws\/credentials HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccep",
"method": "GET",
"path": "\/.aws\/credentials",
"user_agent": "python-requests\/2.34.2",
"waf_tags": [
"950468:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/.aws\/credentials HTTP\/1.1",
"request_sample": "GET \/.aws\/credentials HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/.aws\/credentials HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccep",
"evidence": {
"method": "GET",
"path": "\/.aws\/credentials",
"user_agent": "python-requests\/2.34.2",
"waf_tags": [
"950468:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/.aws\/credentials HTTP\/1.1",
"request_sample": "GET \/.aws\/credentials HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/.aws\/credentials HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccep",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4ce0e86ffddc0aaef4da06dec9059136e3d230b2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.aws\/credentials",
"request_line": "GET \/.aws\/credentials HTTP\/1.1",
"http_user_agent": "python-requests\/2.34.2",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.aws\/credentials HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccep",
"attack_vector": "credential file probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.aws\/credentials",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 44,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8001,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-credential-file",
"pat-0468",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-credential-file",
"pat-0468",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.aws\/credentials",
"request_line": "GET \/.aws\/credentials HTTP\/1.1",
"http_user_agent": "python-requests\/2.34.2",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.aws\/credentials",
"evidence_snippet": "GET \/.aws\/credentials HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccep",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"anomaly:scanner-ua",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
8001 · HTTP
|
http
|
Sonde fichier credential / clé
credential file probe · via HTTP:8001 · (tentative d'exploit) · → /credentials
|
Élevée
|
Moyen · 51
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /credentials UA python-requests/2.34.2
Émulateur
HTTP
WAF
3
Recommandation
Investiguer
Tags
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
net_web_probe
Cible HTTP
GET
/credentials
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8001
Chemin / cible
/credentials
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « scanner-ua » · confiance 97%
Confiance classification
97%
Risque capteur
Moyen
· 51
Confiance : Confiance 97 % — 1 tag(s) WAF
Protocole émulé
1
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /credentials HTTP/1.1
User-Agent
python-requests/2.34.2
Règles WAF
scanner-ua
Payload (extrait)
GET /credentials HTTP/1.1
Host: 62.3.50.33:8001
User-Agent: python-requests/2.34.2
Accept-Encoding: gzip, deflate
Accept: */
Requête brute (extrait)
GET /credentials HTTP/1.1 Host: 62.3.50.33:8001 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "39629e9324a6a8ca42f0eb616186476a68e5066b",
"http_host_hash": "29d114ae8a3567c5f1863f5bd79c5d398a432fe8",
"http_target_hash": "c2da07cc764ea0423e914c1d4964225f44a37d02",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 157,
"payload_entropy": 5.104851741165303,
"port_category": "registered",
"org": "Baykov Ilya Sergeevich",
"service": "http",
"app_proto": "http",
"asn": 41745,
"country": "FR",
"dst_port": 8001,
"risk_waf": 20,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 1.9,
"risk_breakdown": {
"waf": 20,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 20
},
"risk_score": 51,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "4380c5232a82e7d6422be938c609f5b66cf3afdf",
"event_fingerprint": "d41a6ec88f0935139e81f83f22ca41553720b007",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 97%",
"confidence": 0.97,
"classification_confidence": 0.97,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 20,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 20,
"risk_score": 51
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 41745,
"org": "Baykov Ilya Sergeevich",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8828b706bdd52f2a93e84929e06411ae",
"payload_hash": "58186cc58dfba89c7e8484faaafef45d",
"path_pattern_hash": "073a57ca95be8adbd863c70f62d765c2"
},
"target_context": {
"dst_port": 8001,
"service": "http",
"service_name": "http",
"risk_score": 51
},
"payload_preview": "GET \/credentials HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/",
"method": "GET",
"path": "\/credentials",
"user_agent": "python-requests\/2.34.2",
"waf_tags": [
"scanner-ua"
],
"waf_rule_names": [
"scanner-ua"
],
"request_line": "GET \/credentials HTTP\/1.1",
"request_sample": "GET \/credentials HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/credentials HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/",
"evidence": {
"method": "GET",
"path": "\/credentials",
"user_agent": "python-requests\/2.34.2",
"waf_tags": [
"scanner-ua"
],
"waf_rule_names": [
"scanner-ua"
],
"request_line": "GET \/credentials HTTP\/1.1",
"request_sample": "GET \/credentials HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/credentials HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0aed515b4adcdfe2309de97f95f225f0b89b4d61",
"protocol_details": {
"http_method": "GET",
"http_path": "\/credentials",
"request_line": "GET \/credentials HTTP\/1.1",
"http_user_agent": "python-requests\/2.34.2",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/credentials HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/",
"attack_vector": "credential file probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/credentials",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 97%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 97%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 97 % \u2014 via HTTP",
"confidence_pct": 97,
"confidence_breakdown": {
"waf": 20,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 20,
"risk_score": 51
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 51,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8001,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/credentials",
"request_line": "GET \/credentials HTTP\/1.1",
"http_user_agent": "python-requests\/2.34.2",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/credentials",
"evidence_snippet": "GET \/credentials HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 97 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"anomaly:scanner-ua",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
8001 · HTTP
|
http
|
Sonde fichier credential / clé
credential file probe · via HTTP:8001 · (tentative d'exploit) · → /config/credentials.json
|
Élevée
|
Moyen · 51
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /config/credentials.json UA python-requests/2.34.2
Émulateur
HTTP
WAF
9
Recommandation
Investiguer
Tags
950468:nosqli-3
scanner-ua
anomaly:scanner-ua
http_probe_config
Cible HTTP
GET
/config/credentials.json
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8001
Chemin / cible
/config/credentials.json
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « nosqli-3 » · confiance 97%
Confiance classification
97%
Risque capteur
Moyen
· 51
Confiance : Confiance 97 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
pat-0472
Upstream
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Credentials JSON
Ligne de requête
GET /config/credentials.json HTTP/1.1
User-Agent
python-requests/2.34.2
Règles WAF
nosqli-3
scanner-ua
Payload (extrait)
GET /config/credentials.json HTTP/1.1
Host: 62.3.50.33:8001
User-Agent: python-requests/2.34.2
Accept-Encoding: gzip, deflate
Requête brute (extrait)
GET /config/credentials.json HTTP/1.1 Host: 62.3.50.33:8001 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "39629e9324a6a8ca42f0eb616186476a68e5066b",
"http_host_hash": "29d114ae8a3567c5f1863f5bd79c5d398a432fe8",
"http_target_hash": "5234289420e6776a17bc2d2e029b5e8f0af33b10",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 169,
"payload_entropy": 5.115671707467987,
"port_category": "registered",
"org": "Baykov Ilya Sergeevich",
"service": "http",
"app_proto": "http",
"asn": 41745,
"country": "FR",
"dst_port": 8001,
"risk_waf": 44,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 44,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 51,
"tag_count": 6,
"anomaly_count": 1,
"campaign_key": "44bfe03517a4bded67b2f561cdc72122215d1af1",
"event_fingerprint": "12bf8fdba7395d5736f9e87dd09d8983fbd982da",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 confiance 97%",
"confidence": 0.97,
"classification_confidence": 0.97,
"precision_score": 105,
"precision_signals": [
"pat-0472",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0472",
"INT-upstream"
],
"matched_patterns": [
"pat-0472"
],
"matched_pattern_names": [
"Cred Credentials JSON"
],
"pattern_ids": [
"pat-0472"
],
"confidence_breakdown": {
"waf": 44,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 51
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 41745,
"org": "Baykov Ilya Sergeevich",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8828b706bdd52f2a93e84929e06411ae",
"payload_hash": "1880a903b6ae75d57c405b18afd6ddba",
"path_pattern_hash": "a434f033cdfe1c6228665bc262140ac0"
},
"target_context": {
"dst_port": 8001,
"service": "http",
"service_name": "http",
"risk_score": 51
},
"payload_preview": "GET \/config\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate",
"method": "GET",
"path": "\/config\/credentials.json",
"user_agent": "python-requests\/2.34.2",
"waf_tags": [
"950468:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/config\/credentials.json HTTP\/1.1",
"request_sample": "GET \/config\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/config\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate",
"evidence": {
"method": "GET",
"path": "\/config\/credentials.json",
"user_agent": "python-requests\/2.34.2",
"waf_tags": [
"950468:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/config\/credentials.json HTTP\/1.1",
"request_sample": "GET \/config\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/config\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9400aee62bcf3b9251cd12b06222573f7cc3d169",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/credentials.json",
"request_line": "GET \/config\/credentials.json HTTP\/1.1",
"http_user_agent": "python-requests\/2.34.2",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate",
"attack_vector": "credential file probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/credentials.json",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 confiance 97%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 confiance 97%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 97 % \u2014 via HTTP",
"confidence_pct": 97,
"confidence_breakdown": {
"waf": 44,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 51
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 51,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8001,
"protocol_emulated": true,
"tags_summary": [
"pat-0472",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0472",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/credentials.json",
"request_line": "GET \/config\/credentials.json HTTP\/1.1",
"http_user_agent": "python-requests\/2.34.2",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/credentials.json",
"evidence_snippet": "GET \/config\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 97 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"anomaly:scanner-ua",
"http_probe_config",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
8001 · HTTP
|
http
|
Sonde port 8001/TCP
port 8001 tcp · via HTTP:8001 · (sonde / probe) · → /keys.json
|
Élevée
|
Faible · 38
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /keys.json UA python-requests/2.34.2
Émulateur
HTTP
WAF
3
Recommandation
Surveiller
Tags
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
net_web_probe
Cible HTTP
GET
/keys.json
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8001
Chemin / cible
/keys.json
Preuve honeypot — Sonde port 8001/TCP
Connexion détectée sur le port 8001 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_8001_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 38
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 1 tag(s) WAF
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /keys.json HTTP/1.1
User-Agent
python-requests/2.34.2
Règles WAF
scanner-ua
Payload (extrait)
GET /keys.json HTTP/1.1
Host: 62.3.50.33:8001
User-Agent: python-requests/2.34.2
Accept-Encoding: gzip, deflate
Accept: */*
Requête brute (extrait)
GET /keys.json HTTP/1.1 Host: 62.3.50.33:8001 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "json",
"http_ua_hash": "39629e9324a6a8ca42f0eb616186476a68e5066b",
"http_host_hash": "29d114ae8a3567c5f1863f5bd79c5d398a432fe8",
"http_target_hash": "c3ac892564a71141581a4e5efe8d4174457be60d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 155,
"payload_entropy": 5.139103532991857,
"port_category": "registered",
"org": "Baykov Ilya Sergeevich",
"service": "http",
"app_proto": "http",
"asn": 41745,
"country": "FR",
"dst_port": 8001,
"risk_waf": 20,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 1.9,
"risk_breakdown": {
"waf": 20,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 20
},
"risk_score": 38,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "38feb57ceb42e6361b742e608c318e1887ed1fe5",
"event_fingerprint": "80f43a84449c5602017b56e9d8ba7842e98e53dc",
"classification_reason": "Type \u00ab port_8001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 20,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 20,
"risk_score": 38
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 41745,
"org": "Baykov Ilya Sergeevich",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8828b706bdd52f2a93e84929e06411ae",
"payload_hash": "fa03aec006daedbb2e57aa3432ff1a56",
"path_pattern_hash": "ac1c8497c117520986c9f2f44ae6cfa7"
},
"target_context": {
"dst_port": 8001,
"service": "http",
"service_name": "http",
"risk_score": 38
},
"payload_preview": "GET \/keys.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r",
"method": "GET",
"path": "\/keys.json",
"user_agent": "python-requests\/2.34.2",
"waf_tags": [
"scanner-ua"
],
"waf_rule_names": [
"scanner-ua"
],
"request_line": "GET \/keys.json HTTP\/1.1",
"request_sample": "GET \/keys.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/keys.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*",
"evidence": {
"method": "GET",
"path": "\/keys.json",
"user_agent": "python-requests\/2.34.2",
"waf_tags": [
"scanner-ua"
],
"waf_rule_names": [
"scanner-ua"
],
"request_line": "GET \/keys.json HTTP\/1.1",
"request_sample": "GET \/keys.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/keys.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*",
"classification_reason": "Type \u00ab port_8001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6cbb6702bb48718ebb046a80aefce4807e6b473b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/keys.json",
"request_line": "GET \/keys.json HTTP\/1.1",
"http_user_agent": "python-requests\/2.34.2",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/keys.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*",
"attack_vector": "port 8001 tcp \u00b7 via HTTP:8001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/keys.json",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_8001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_8001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 20,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 20,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8001,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/keys.json",
"request_line": "GET \/keys.json HTTP\/1.1",
"http_user_agent": "python-requests\/2.34.2",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 8001 tcp \u00b7 via HTTP:8001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/keys.json",
"evidence_snippet": "GET \/keys.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"anomaly:scanner-ua",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
8001 · HTTP
|
http
|
Sonde fichier credential / clé
credential file probe · via HTTP:8001 · (tentative d'exploit) · → /secrets.json
|
Élevée
|
Moyen · 51
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /secrets.json UA python-requests/2.34.2
Émulateur
HTTP
WAF
3
Recommandation
Investiguer
Tags
scanner-ua
anomaly:scanner-ua
http_k8s_probe
http_ua_suspicious
Cible HTTP
GET
/secrets.json
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8001
Chemin / cible
/secrets.json
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « scanner-ua » · confiance 97%
Confiance classification
97%
Risque capteur
Moyen
· 51
Confiance : Confiance 97 % — Motif catalogue confirmé · 1 tag(s) WAF
Protocole émulé
1
Signaux
pat-0496
Upstream
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Secrets JSON file
Ligne de requête
GET /secrets.json HTTP/1.1
User-Agent
python-requests/2.34.2
Règles WAF
scanner-ua
Payload (extrait)
GET /secrets.json HTTP/1.1
Host: 62.3.50.33:8001
User-Agent: python-requests/2.34.2
Accept-Encoding: gzip, deflate
Accept: *
Requête brute (extrait)
GET /secrets.json HTTP/1.1 Host: 62.3.50.33:8001 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "json",
"http_ua_hash": "39629e9324a6a8ca42f0eb616186476a68e5066b",
"http_host_hash": "29d114ae8a3567c5f1863f5bd79c5d398a432fe8",
"http_target_hash": "9906f032745691753325e07cb911e68c17846b5d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 158,
"payload_entropy": 5.101229360885723,
"port_category": "registered",
"org": "Baykov Ilya Sergeevich",
"service": "http",
"app_proto": "http",
"asn": 41745,
"country": "FR",
"dst_port": 8001,
"risk_waf": 20,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 2.2,
"risk_breakdown": {
"waf": 20,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 51,
"tag_count": 5,
"anomaly_count": 1,
"campaign_key": "7996089b2161e72cadedf341b0526a7484f30c6a",
"event_fingerprint": "0750ba3802035047e616e291d6b5c7c44e75c559",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 97%",
"confidence": 0.97,
"classification_confidence": 0.97,
"precision_score": 105,
"precision_signals": [
"pat-0496",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0496",
"INT-upstream"
],
"matched_patterns": [
"pat-0496"
],
"matched_pattern_names": [
"Cred Secrets JSON file"
],
"pattern_ids": [
"pat-0496"
],
"confidence_breakdown": {
"waf": 20,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 51
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 41745,
"org": "Baykov Ilya Sergeevich",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8828b706bdd52f2a93e84929e06411ae",
"payload_hash": "70f30bb9c9f13545f234ee874f60fc41",
"path_pattern_hash": "1abd330c58113f23df400bb25a78bd81"
},
"target_context": {
"dst_port": 8001,
"service": "http",
"service_name": "http",
"risk_score": 51
},
"payload_preview": "GET \/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *",
"method": "GET",
"path": "\/secrets.json",
"user_agent": "python-requests\/2.34.2",
"waf_tags": [
"scanner-ua"
],
"waf_rule_names": [
"scanner-ua"
],
"request_line": "GET \/secrets.json HTTP\/1.1",
"request_sample": "GET \/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *",
"evidence": {
"method": "GET",
"path": "\/secrets.json",
"user_agent": "python-requests\/2.34.2",
"waf_tags": [
"scanner-ua"
],
"waf_rule_names": [
"scanner-ua"
],
"request_line": "GET \/secrets.json HTTP\/1.1",
"request_sample": "GET \/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d58cad4dff1370b57cc97b70bc5217aadf546a03",
"protocol_details": {
"http_method": "GET",
"http_path": "\/secrets.json",
"request_line": "GET \/secrets.json HTTP\/1.1",
"http_user_agent": "python-requests\/2.34.2",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *",
"attack_vector": "credential file probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/secrets.json",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 97%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 97%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 97 % \u2014 via HTTP",
"confidence_pct": 97,
"confidence_breakdown": {
"waf": 20,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 51
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 51,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8001,
"protocol_emulated": true,
"tags_summary": [
"pat-0496",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0496",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/secrets.json",
"request_line": "GET \/secrets.json HTTP\/1.1",
"http_user_agent": "python-requests\/2.34.2",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/secrets.json",
"evidence_snippet": "GET \/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 97 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"anomaly:scanner-ua",
"http_k8s_probe",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
8001 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8001 · (tentative d'exploit) · → /.env
|
Élevée
|
Moyen · 47
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env UA python-requests/2.34.2
Émulateur
HTTP
WAF
11
Recommandation
Surveiller
Tags
950514:leak-1
scanner-ua
anomaly:scanner-ua
http_backup_file_scan
Cible HTTP
GET
/.env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8001
Chemin / cible
/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « leak-1 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 47
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env HTTP/1.1
User-Agent
python-requests/2.34.2
Règles WAF
leak-1
scanner-ua
Payload (extrait)
GET /.env HTTP/1.1
Host: 62.3.50.33:8001
User-Agent: python-requests/2.34.2
Accept-Encoding: gzip, deflate
Accept: */*
Conn
Requête brute (extrait)
GET /.env HTTP/1.1 Host: 62.3.50.33:8001 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "env",
"http_ua_hash": "39629e9324a6a8ca42f0eb616186476a68e5066b",
"http_host_hash": "29d114ae8a3567c5f1863f5bd79c5d398a432fe8",
"http_target_hash": "9ee0d3f55b39072ba6bec6203d26e470be80afdc",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 150,
"payload_entropy": 5.109963186032197,
"port_category": "registered",
"org": "Baykov Ilya Sergeevich",
"service": "http",
"app_proto": "http",
"asn": 41745,
"country": "FR",
"dst_port": 8001,
"risk_waf": 52,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 52,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 47,
"tag_count": 8,
"anomaly_count": 1,
"campaign_key": "02cac18ea5c4efa68c016f74f1664591812759dd",
"event_fingerprint": "bf2757f43b0914ca23e99a975f4fa707d31119a5",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 52,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 47
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 41745,
"org": "Baykov Ilya Sergeevich",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8828b706bdd52f2a93e84929e06411ae",
"payload_hash": "521149286899fde6670780bb5ecbe38c",
"path_pattern_hash": "aef81e7735de8f42b73e111497498c8b"
},
"target_context": {
"dst_port": 8001,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConn",
"method": "GET",
"path": "\/.env",
"user_agent": "python-requests\/2.34.2",
"waf_tags": [
"950514:leak-1",
"scanner-ua"
],
"waf_rule_names": [
"leak-1",
"scanner-ua"
],
"request_line": "GET \/.env HTTP\/1.1",
"request_sample": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConn",
"evidence": {
"method": "GET",
"path": "\/.env",
"user_agent": "python-requests\/2.34.2",
"waf_tags": [
"950514:leak-1",
"scanner-ua"
],
"waf_rule_names": [
"leak-1",
"scanner-ua"
],
"request_line": "GET \/.env HTTP\/1.1",
"request_sample": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConn",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5d50f993a6d5b27d38ca683b2b77ee8e7b1a2acb",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env",
"request_line": "GET \/.env HTTP\/1.1",
"http_user_agent": "python-requests\/2.34.2",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConn",
"attack_vector": "config file probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 52,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 47
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8001,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env",
"request_line": "GET \/.env HTTP\/1.1",
"http_user_agent": "python-requests\/2.34.2",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env",
"evidence_snippet": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConn",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 52 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950514:leak-1",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_probe_env",
"http_sensitive_path",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
8001 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8001 · (tentative d'exploit) · → /api/.env
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /api/.env UA python-requests/2.34.2
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950468:nosqli-3
950514:leak-1
950600:k8s-api
scanner-ua
Cible HTTP
GET
/api/.env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8001
Chemin / cible
/api/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /api/.env HTTP/1.1
User-Agent
python-requests/2.34.2
Règles WAF
nosqli-3
leak-1
k8s-api
scanner-ua
Payload (extrait)
GET /api/.env HTTP/1.1
Host: 62.3.50.33:8001
User-Agent: python-requests/2.34.2
Accept-Encoding: gzip, deflate
Accept: */*
Requête brute (extrait)
GET /api/.env HTTP/1.1 Host: 62.3.50.33:8001 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "39629e9324a6a8ca42f0eb616186476a68e5066b",
"http_host_hash": "29d114ae8a3567c5f1863f5bd79c5d398a432fe8",
"http_target_hash": "f5b7d21cf92d5caca6cd906725e72730e31bc18c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 154,
"payload_entropy": 5.112873367639843,
"port_category": "registered",
"org": "Baykov Ilya Sergeevich",
"service": "http",
"app_proto": "http",
"asn": 41745,
"country": "FR",
"dst_port": 8001,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 58,
"tag_count": 10,
"anomaly_count": 1,
"campaign_key": "40a5e76137c2b43933f8689db84ab88c5b27f58e",
"event_fingerprint": "2df6d17a94b0ae7347b588dba791105d9d736afc",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 58
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 41745,
"org": "Baykov Ilya Sergeevich",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8828b706bdd52f2a93e84929e06411ae",
"payload_hash": "84a918842c8f6889947dd35a30ed7393",
"path_pattern_hash": "3c658e3b68f996f41891a76e1d05a9a5"
},
"target_context": {
"dst_port": 8001,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\n",
"method": "GET",
"path": "\/api\/.env",
"user_agent": "python-requests\/2.34.2",
"waf_tags": [
"950468:nosqli-3",
"950514:leak-1",
"950600:k8s-api",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"leak-1",
"k8s-api",
"scanner-ua"
],
"request_line": "GET \/api\/.env HTTP\/1.1",
"request_sample": "GET \/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*",
"evidence": {
"method": "GET",
"path": "\/api\/.env",
"user_agent": "python-requests\/2.34.2",
"waf_tags": [
"950468:nosqli-3",
"950514:leak-1",
"950600:k8s-api",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"leak-1",
"k8s-api",
"scanner-ua"
],
"request_line": "GET \/api\/.env HTTP\/1.1",
"request_sample": "GET \/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "12163006c4c6dd9cd39c6d9737c6ebeca1f4ec27",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/.env",
"request_line": "GET \/api\/.env HTTP\/1.1",
"http_user_agent": "python-requests\/2.34.2",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*",
"attack_vector": "config file probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.env",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 58
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8001,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/.env",
"request_line": "GET \/api\/.env HTTP\/1.1",
"http_user_agent": "python-requests\/2.34.2",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.env",
"evidence_snippet": "GET \/api\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950514:leak-1",
"950600:k8s-api",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_probe_api",
"http_sensitive_path",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
8001 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8001 · (tentative d'exploit) · → /.env.local
|
Élevée
|
Moyen · 47
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.local UA python-requests/2.34.2
Émulateur
HTTP
WAF
11
Recommandation
Surveiller
Tags
950514:leak-1
scanner-ua
anomaly:scanner-ua
http_backup_file_scan
Cible HTTP
GET
/.env.local
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8001
Chemin / cible
/.env.local
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « leak-1 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 47
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
pat-0193
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Probe /.env.local
Ligne de requête
GET /.env.local HTTP/1.1
User-Agent
python-requests/2.34.2
Règles WAF
leak-1
scanner-ua
Payload (extrait)
GET /.env.local HTTP/1.1
Host: 62.3.50.33:8001
User-Agent: python-requests/2.34.2
Accept-Encoding: gzip, deflate
Accept: */*
Requête brute (extrait)
GET /.env.local HTTP/1.1 Host: 62.3.50.33:8001 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "local",
"http_ua_hash": "39629e9324a6a8ca42f0eb616186476a68e5066b",
"http_host_hash": "29d114ae8a3567c5f1863f5bd79c5d398a432fe8",
"http_target_hash": "1bd3d14a0dcd500ff7a77dd7b961ff8960851334",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 156,
"payload_entropy": 5.112494701572001,
"port_category": "registered",
"org": "Baykov Ilya Sergeevich",
"service": "http",
"app_proto": "http",
"asn": 41745,
"country": "FR",
"dst_port": 8001,
"risk_waf": 52,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 52,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 47,
"tag_count": 8,
"anomaly_count": 1,
"campaign_key": "8e64f6028308afbdcc53bacb201b3739c557caa9",
"event_fingerprint": "487ab6f816a5d9eeb38940fb88073fed347869fc",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 325,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"pat-0193",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"pat-0193",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191",
"pat-0193"
],
"matched_pattern_names": [
"Probe \/.env",
"Probe \/.env.local"
],
"pattern_ids": [
"pat-0191",
"pat-0193"
],
"confidence_breakdown": {
"waf": 52,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 47
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 41745,
"org": "Baykov Ilya Sergeevich",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8828b706bdd52f2a93e84929e06411ae",
"payload_hash": "205e24c2d0c58ebb2f1d269312b0de07",
"path_pattern_hash": "b9c24fc1b97f40588adfd0796c248786"
},
"target_context": {
"dst_port": 8001,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*",
"method": "GET",
"path": "\/.env.local",
"user_agent": "python-requests\/2.34.2",
"waf_tags": [
"950514:leak-1",
"scanner-ua"
],
"waf_rule_names": [
"leak-1",
"scanner-ua"
],
"request_line": "GET \/.env.local HTTP\/1.1",
"request_sample": "GET \/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*",
"evidence": {
"method": "GET",
"path": "\/.env.local",
"user_agent": "python-requests\/2.34.2",
"waf_tags": [
"950514:leak-1",
"scanner-ua"
],
"waf_rule_names": [
"leak-1",
"scanner-ua"
],
"request_line": "GET \/.env.local HTTP\/1.1",
"request_sample": "GET \/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9b97cc9fc2dcf88301a882ce9ba3e6235c5b361f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.local",
"request_line": "GET \/.env.local HTTP\/1.1",
"http_user_agent": "python-requests\/2.34.2",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*",
"attack_vector": "config file probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.local",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 52,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 47
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8001,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"pat-0193"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"pat-0193"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.local",
"request_line": "GET \/.env.local HTTP\/1.1",
"http_user_agent": "python-requests\/2.34.2",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.local",
"evidence_snippet": "GET \/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 52 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950514:leak-1",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_probe_env_local",
"http_sensitive_path",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
8001 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8001 · (tentative d'exploit) · → /config.json
|
Élevée
|
Moyen · 47
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /config.json UA python-requests/2.34.2
Émulateur
HTTP
WAF
3
Recommandation
Surveiller
Tags
scanner-ua
anomaly:scanner-ua
http_sensitive_path
http_ua_suspicious
Cible HTTP
GET
/config.json
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8001
Chemin / cible
/config.json
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « scanner-ua » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 47
Confiance : Confiance 100 % — Motif catalogue confirmé · 1 tag(s) WAF
Protocole émulé
1
Signaux
Http Sensitive
pat-0247
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /config.json
Ligne de requête
GET /config.json HTTP/1.1
User-Agent
python-requests/2.34.2
Règles WAF
scanner-ua
Payload (extrait)
GET /config.json HTTP/1.1
Host: 62.3.50.33:8001
User-Agent: python-requests/2.34.2
Accept-Encoding: gzip, deflate
Accept: */
Requête brute (extrait)
GET /config.json HTTP/1.1 Host: 62.3.50.33:8001 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "json",
"http_ua_hash": "39629e9324a6a8ca42f0eb616186476a68e5066b",
"http_host_hash": "29d114ae8a3567c5f1863f5bd79c5d398a432fe8",
"http_target_hash": "110dc2bb220538a9df6ea13fd8474a5056c773dc",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 157,
"payload_entropy": 5.129528830215796,
"port_category": "registered",
"org": "Baykov Ilya Sergeevich",
"service": "http",
"app_proto": "http",
"asn": 41745,
"country": "FR",
"dst_port": 8001,
"risk_waf": 20,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 2.2,
"risk_breakdown": {
"waf": 20,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 47,
"tag_count": 5,
"anomaly_count": 1,
"campaign_key": "01bfd190e3d654c6eda1be7e068b9df2ddc7bdcc",
"event_fingerprint": "257e282dd1a175585709d3b064aa2742b657a638",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 152,
"precision_signals": [
"INT-http_sensitive",
"pat-0247",
"INT-upstream"
],
"kb_rule_ids": [
"INT-http_sensitive",
"pat-0247",
"INT-upstream"
],
"matched_patterns": [
"pat-0247"
],
"matched_pattern_names": [
"Probe \/config.json"
],
"pattern_ids": [
"pat-0247"
],
"confidence_breakdown": {
"waf": 20,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 47
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 41745,
"org": "Baykov Ilya Sergeevich",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8828b706bdd52f2a93e84929e06411ae",
"payload_hash": "4cbfcbef85387a8ead5fc2489b8b2e69",
"path_pattern_hash": "b2ebf86a95e6e198c8d34ea73388c4ce"
},
"target_context": {
"dst_port": 8001,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/",
"method": "GET",
"path": "\/config.json",
"user_agent": "python-requests\/2.34.2",
"waf_tags": [
"scanner-ua"
],
"waf_rule_names": [
"scanner-ua"
],
"request_line": "GET \/config.json HTTP\/1.1",
"request_sample": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/",
"evidence": {
"method": "GET",
"path": "\/config.json",
"user_agent": "python-requests\/2.34.2",
"waf_tags": [
"scanner-ua"
],
"waf_rule_names": [
"scanner-ua"
],
"request_line": "GET \/config.json HTTP\/1.1",
"request_sample": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "07af2b1a3212ae64d1d4ad7b88451ffab0ef4fef",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config.json",
"request_line": "GET \/config.json HTTP\/1.1",
"http_user_agent": "python-requests\/2.34.2",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/",
"attack_vector": "config file probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config.json",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 20,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 47
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8001,
"protocol_emulated": true,
"tags_summary": [
"INT-http_sensitive",
"pat-0247",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"pat-0247",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config.json",
"request_line": "GET \/config.json HTTP\/1.1",
"http_user_agent": "python-requests\/2.34.2",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config.json",
"evidence_snippet": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"anomaly:scanner-ua",
"http_sensitive_path",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
8001 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8001 · (tentative d'exploit) · → /settings.json
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /settings.json UA python-requests/2.34.2
Émulateur
HTTP
WAF
3
Recommandation
Surveiller
Tags
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
net_web_probe
Cible HTTP
GET
/settings.json
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8001
Chemin / cible
/settings.json
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « scanner-ua » · confiance 97%
Confiance classification
97%
Risque capteur
Moyen
· 46
Confiance : Confiance 97 % — 1 tag(s) WAF
Protocole émulé
1
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /settings.json HTTP/1.1
User-Agent
python-requests/2.34.2
Règles WAF
scanner-ua
Payload (extrait)
GET /settings.json HTTP/1.1
Host: 62.3.50.33:8001
User-Agent: python-requests/2.34.2
Accept-Encoding: gzip, deflate
Accept:
Requête brute (extrait)
GET /settings.json HTTP/1.1 Host: 62.3.50.33:8001 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "json",
"http_ua_hash": "39629e9324a6a8ca42f0eb616186476a68e5066b",
"http_host_hash": "29d114ae8a3567c5f1863f5bd79c5d398a432fe8",
"http_target_hash": "bf7030628c229b3e041c7e1c251921a9918e64a1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 159,
"payload_entropy": 5.099151486177599,
"port_category": "registered",
"org": "Baykov Ilya Sergeevich",
"service": "http",
"app_proto": "http",
"asn": 41745,
"country": "FR",
"dst_port": 8001,
"risk_waf": 20,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 1.9,
"risk_breakdown": {
"waf": 20,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 20
},
"risk_score": 46,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "dc52083b7dea2d71f6b47271e81584e7e5527f32",
"event_fingerprint": "f7de3d7501d5ea0f1da9ad1745c1c76fbe5c9349",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 97%",
"confidence": 0.97,
"classification_confidence": 0.97,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 20,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 20,
"risk_score": 46
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 41745,
"org": "Baykov Ilya Sergeevich",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8828b706bdd52f2a93e84929e06411ae",
"payload_hash": "071a5bcca5f538b0c137085d1bb84086",
"path_pattern_hash": "77c44ac5d0e9de12fccd3bb6237f7ba5"
},
"target_context": {
"dst_port": 8001,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: ",
"method": "GET",
"path": "\/settings.json",
"user_agent": "python-requests\/2.34.2",
"waf_tags": [
"scanner-ua"
],
"waf_rule_names": [
"scanner-ua"
],
"request_line": "GET \/settings.json HTTP\/1.1",
"request_sample": "GET \/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept:",
"evidence": {
"method": "GET",
"path": "\/settings.json",
"user_agent": "python-requests\/2.34.2",
"waf_tags": [
"scanner-ua"
],
"waf_rule_names": [
"scanner-ua"
],
"request_line": "GET \/settings.json HTTP\/1.1",
"request_sample": "GET \/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept:",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "252e54ead4cd922e31f54313e3d833c04af5143f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/settings.json",
"request_line": "GET \/settings.json HTTP\/1.1",
"http_user_agent": "python-requests\/2.34.2",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept:",
"attack_vector": "config file probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/settings.json",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 97%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 97%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 97 % \u2014 via HTTP",
"confidence_pct": 97,
"confidence_breakdown": {
"waf": 20,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 20,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8001,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/settings.json",
"request_line": "GET \/settings.json HTTP\/1.1",
"http_user_agent": "python-requests\/2.34.2",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/settings.json",
"evidence_snippet": "GET \/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept:",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 97 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"anomaly:scanner-ua",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
8001 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8001 · (tentative d'exploit) · → /app/config.json
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /app/config.json UA python-requests/2.34.2
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950468:nosqli-3
scanner-ua
anomaly:scanner-ua
http_sensitive_path
Cible HTTP
GET
/app/config.json
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8001
Chemin / cible
/app/config.json
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 97%
Confiance classification
97%
Risque capteur
Moyen
· 46
Confiance : Confiance 97 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
Http Sensitive
Upstream
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /app/config.json HTTP/1.1
User-Agent
python-requests/2.34.2
Règles WAF
nosqli-3
scanner-ua
Payload (extrait)
GET /app/config.json HTTP/1.1
Host: 62.3.50.33:8001
User-Agent: python-requests/2.34.2
Accept-Encoding: gzip, deflate
Accept
Requête brute (extrait)
GET /app/config.json HTTP/1.1 Host: 62.3.50.33:8001 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "39629e9324a6a8ca42f0eb616186476a68e5066b",
"http_host_hash": "29d114ae8a3567c5f1863f5bd79c5d398a432fe8",
"http_target_hash": "04a99df4e7f26fbef3b59fc449247949b0b5c67b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 161,
"payload_entropy": 5.130135491849569,
"port_category": "registered",
"org": "Baykov Ilya Sergeevich",
"service": "http",
"app_proto": "http",
"asn": 41745,
"country": "FR",
"dst_port": 8001,
"risk_waf": 44,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 44,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 46,
"tag_count": 6,
"anomaly_count": 1,
"campaign_key": "0df2fc882cceb5c26b7075b87e0d971fb63908d0",
"event_fingerprint": "21f0c49f1ddf3d13ea54904b8383a5c9ca1550f0",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"confidence": 0.97,
"classification_confidence": 0.97,
"precision_score": 97,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 44,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 46
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 41745,
"org": "Baykov Ilya Sergeevich",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8828b706bdd52f2a93e84929e06411ae",
"payload_hash": "5047d2ddc810323ad7aa45f5c2e8243c",
"path_pattern_hash": "4ea6034329b7a9b73f791b1e3c4a9abe"
},
"target_context": {
"dst_port": 8001,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/app\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept",
"method": "GET",
"path": "\/app\/config.json",
"user_agent": "python-requests\/2.34.2",
"waf_tags": [
"950468:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/app\/config.json HTTP\/1.1",
"request_sample": "GET \/app\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/app\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept",
"evidence": {
"method": "GET",
"path": "\/app\/config.json",
"user_agent": "python-requests\/2.34.2",
"waf_tags": [
"950468:nosqli-3",
"scanner-ua"
],
"waf_rule_names": [
"nosqli-3",
"scanner-ua"
],
"request_line": "GET \/app\/config.json HTTP\/1.1",
"request_sample": "GET \/app\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "GET \/app\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b48758c89c551f33e894b1381e9e418222417371",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/config.json",
"request_line": "GET \/app\/config.json HTTP\/1.1",
"http_user_agent": "python-requests\/2.34.2",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/app\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept",
"attack_vector": "config file probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/config.json",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 97 % \u2014 via HTTP",
"confidence_pct": 97,
"confidence_breakdown": {
"waf": 44,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8001,
"protocol_emulated": true,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/config.json",
"request_line": "GET \/app\/config.json HTTP\/1.1",
"http_user_agent": "python-requests\/2.34.2",
"port": 8001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/config.json",
"evidence_snippet": "GET \/app\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: python-requests\/2.34.2\r\nAccept-Encoding: gzip, deflate\r\nAccept",
"target_port_label": "8001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 97 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"anomaly:scanner-ua",
"http_sensitive_path",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|