|
|
TCP |
3 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:3 · (tentative d'exploit)
|
Élevée
|
Moyen · 53
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 53
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "well_known",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 3,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.9,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 53,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "13931841fe470fd0dea19f04ac110e7c1c3f3fd7",
"event_fingerprint": "ac792ce0c580cfb87350d2ae4df467c52b3b0a1c",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 53
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 3,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "31ce7042a596d4c49ce4b86e7a45a4b8dd5643ce",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 3,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:3 \u00b7 (tentative d'exploit)",
"target_port_label": "3 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 53
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3,
"protocol_emulated": null,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 3,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:3 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "3 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri"
]
}
|
|
|
TCP |
2 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:2 · (tentative d'exploit)
|
Élevée
|
Moyen · 53
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 53
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "well_known",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 2,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 53,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "97c788fe2046c9177aa609aefa38e644fbf19224",
"event_fingerprint": "4365128f1bc2a64805a2fea94888173cacbf9658",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 53
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 2,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "463f464d9022aafa23430344cb5bd614742e6792",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 2,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:2 \u00b7 (tentative d'exploit)",
"target_port_label": "2 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 53
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2,
"protocol_emulated": null,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 2,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:2 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "2 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri"
]
}
|
|
|
TCP |
1 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:1 · (tentative d'exploit)
|
Élevée
|
Moyen · 53
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
1
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 53
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "well_known",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 1,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 53,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "a8663703fe001128f7b1b889b4b5972d11653ea7",
"event_fingerprint": "e56b0b4921ba118aa2d5843e4a4b76ff5c73e4d9",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 53
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 1,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ab63d2c40c94c1f786d75b7b7a8990b64adcd45c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 1,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:1 \u00b7 (tentative d'exploit)",
"target_port_label": "1 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 53
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1,
"protocol_emulated": null,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 1,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:1 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "1 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri"
]
}
|
|
|
TCP |
31280 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:31280 · (tentative d'exploit)
|
Élevée
|
Moyen · 53
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
31280
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 53
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 31280,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 53,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d83885a8122f45fec6735e923ad940d141172add",
"event_fingerprint": "b08c631765b480cace197c04afed9031e5469bf7",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 53
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 31280,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0f7fc371040ae98378051a8d9cee8c88ca3ebc8a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 31280,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:31280 \u00b7 (tentative d'exploit)",
"target_port_label": "31280 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 53
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 31280,
"protocol_emulated": null,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 31280,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:31280 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "31280 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "31280"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri"
]
}
|
|
|
TCP |
30000 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:30000 · (tentative d'exploit)
|
Élevée
|
Moyen · 56
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
30000
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 56
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 30000,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 56,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "d9a9143bd8159e7c6edec7f2b6e606442c1b3b95",
"event_fingerprint": "b7ecfe75b98982857662119cc0c9da5b6268c171",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 56
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 30000,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8931f0e4736a92dc1d38813f5bee0f823dfdc2ea",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 30000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:30000 \u00b7 (tentative d'exploit)",
"target_port_label": "30000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 56
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 30000,
"protocol_emulated": true,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 30000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:30000 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "30000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "30000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"net_web_probe"
]
}
|
|
|
TCP |
28081 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:28081 · (tentative d'exploit)
|
Élevée
|
Moyen · 56
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
28081
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 56
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 28081,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 56,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d66f0a86cd71b447f33a9e8b7f230c98b6346cd6",
"event_fingerprint": "5919c41fa4908732de473a15fa00ab321d6b639e",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 56
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 28081,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "09005494e274b7ef2ed9edfa1de42eb3d681d631",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 28081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:28081 \u00b7 (tentative d'exploit)",
"target_port_label": "28081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 56
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 28081,
"protocol_emulated": null,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 28081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:28081 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "28081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "28081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri"
]
}
|
|
|
TCP |
28080 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:28080 · (tentative d'exploit)
|
Élevée
|
Moyen · 56
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
28080
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 56
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 28080,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 56,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "1b0f3d0286365f9004137d082889000a12d24039",
"event_fingerprint": "e9321a80ddf96fb7f2ea3e5126208a8c8a70d68d",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 56
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 28080,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7e0b8b829795f00b6cfb4350d3b71f236ce0d828",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 28080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:28080 \u00b7 (tentative d'exploit)",
"target_port_label": "28080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 56
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 28080,
"protocol_emulated": null,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 28080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:28080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "28080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "28080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri"
]
}
|
|
|
TCP |
21000 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:21000 · (tentative d'exploit)
|
Élevée
|
Moyen · 54
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
21000
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 21000,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 54,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9355285ccce64791bf98d4b354e9a25952bf108e",
"event_fingerprint": "3fff88167b0225ae7c21ef563912e05793622ff6",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 54
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 21000,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "740daba5a63e34cd8f483d8b935f8b468a36031d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 21000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:21000 \u00b7 (tentative d'exploit)",
"target_port_label": "21000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 54
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 21000,
"protocol_emulated": null,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 21000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:21000 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "21000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "21000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri"
]
}
|
|
|
TCP |
20000 · DNP3 TCP
|
dnp3-tcp
|
dnp3 probe
dnp3 probe · via DNP3 TCP:20000 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T0836
TA0007
TA0001
Protocole
Émulateur
DNP3-TCP
WAF
—
Recommandation
Surveiller
Tags
dnp3_emulated
dnp3_probe
mozi_pattern
net_dnp3_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
20000
Chemin / cible
—
Service
DNP3 TCP
Payload
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Pourquoi cette classification : Type « dnp3_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 45
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
Ot Dnp3 Unauth
Ot Dnp3 Variants
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "05000000000000000000",
"emulator_response_len": 10,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "dnp3-tcp",
"app_proto": "dnp3-tcp",
"asn": 219502,
"country": "NL",
"dst_port": 20000,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2.2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "67d5ed702c403ab762e96fe67e73daf21881a1e2",
"event_fingerprint": "14eebf67fd895c508f4342c40cf9531e8f997d62",
"classification_reason": "Type \u00ab dnp3_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 157,
"precision_signals": [
"INT-OT-dnp3-unauth",
"INT-OT-dnp3-variants",
"INT-upstream"
],
"kb_rule_ids": [
"INT-OT-dnp3-unauth",
"INT-OT-dnp3-variants",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "dnp3-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "859b07b9d78548343d57aca7faf5fc6a"
},
"target_context": {
"dst_port": 20000,
"service": "dnp3-tcp",
"service_name": "dnp3-tcp",
"risk_score": 45
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab dnp3_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T0836"
],
"mitre": "T0836",
"threat_family": [
"ics_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0bc90d9dccf985691ffcd49e9861b8314dad70fb",
"protocol_details": {
"dnp3_probe_fr": "Sonde DNP3 (SCADA \u00e9nergie)",
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"port": 20000,
"service": "dnp3-tcp",
"service_label_fr": "DNP3 TCP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "dnp3 probe \u00b7 via DNP3 TCP:20000 \u00b7 (sonde \/ probe)",
"target_port_label": "20000 \u00b7 DNP3 TCP",
"emulator_service": "dnp3-tcp",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab dnp3_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab dnp3_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "dnp3-tcp",
"service_label_fr": "DNP3 TCP",
"dst_port": 20000,
"protocol_emulated": true,
"tags_summary": [
"INT-OT-dnp3-unauth",
"INT-OT-dnp3-variants",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Ot Dnp3 Unauth",
"Ot Dnp3 Variants",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T0836",
"mitre_technique": "T0836",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-dnp3-tcp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"dnp3_probe_fr": "Sonde DNP3 (SCADA \u00e9nergie)",
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"port": 20000,
"service": "dnp3-tcp",
"service_label_fr": "DNP3 TCP"
},
"attack_vector": "dnp3 probe \u00b7 via DNP3 TCP:20000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "20000 \u00b7 DNP3 TCP",
"emulator_service": "dnp3-tcp",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "dnp3_tcp",
"service_banner": "honeypot-dnp3-tcp",
"service_os": "linux",
"dst_port": "20000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"dnp3_emulated",
"dnp3_probe",
"mozi_pattern",
"net_dnp3_probe"
]
}
|
|
|
TCP |
18080 · MONERO P2P
|
monero-p2p
|
monero probe
monero probe · via MONERO P2P:18080 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MONERO-P2P
WAF
—
Recommandation
Surveiller
Tags
monero_p2p_emulated
monero_p2p_payload
mozi_pattern
net_monero_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
18080
Chemin / cible
—
Service
MONERO P2P
Payload
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Pourquoi cette classification : Type « monero_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 4 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "01110101010101010000000000000000",
"emulator_response_len": 16,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "monero-p2p",
"app_proto": "monero-p2p",
"asn": 219502,
"country": "NL",
"dst_port": 18080,
"risk_waf": 8,
"risk_classification": 53,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 53,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 34,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "3f143756998a97e0bc85f4bd3fb2809e12e8697c",
"event_fingerprint": "9805bd2d8e2babb93b4750898ffa60f92edfba86",
"classification_reason": "Type \u00ab monero_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 53,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "monero-p2p",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "8f5f48fae11b9586096853e48ad6d2da"
},
"target_context": {
"dst_port": 18080,
"service": "monero-p2p",
"service_name": "monero-p2p",
"risk_score": 34
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab monero_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c9e1a9a590d5264506aab671ed4ca0026036b747",
"protocol_details": {
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"port": 18080,
"service": "monero-p2p",
"service_label_fr": "MONERO P2P"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "monero probe \u00b7 via MONERO P2P:18080 \u00b7 (sonde \/ probe)",
"target_port_label": "18080 \u00b7 MONERO P2P",
"emulator_service": "monero-p2p",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab monero_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab monero_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 53,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "monero-p2p",
"service_label_fr": "MONERO P2P",
"dst_port": 18080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-monero-p2p",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"port": 18080,
"service": "monero-p2p",
"service_label_fr": "MONERO P2P"
},
"attack_vector": "monero probe \u00b7 via MONERO P2P:18080 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "18080 \u00b7 MONERO P2P",
"emulator_service": "monero-p2p",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "monero_p2p",
"service_banner": "honeypot-monero-p2p",
"service_os": "linux",
"dst_port": "18080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"monero_p2p_emulated",
"monero_p2p_payload",
"mozi_pattern",
"net_monero_probe"
]
}
|
|
|
TCP |
10888 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:10888 · (tentative d'exploit)
|
Élevée
|
Moyen · 53
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
10888
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 53
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 10888,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 53,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "8a1e94b46593b5fcc23dc47483d5f48a81e810a0",
"event_fingerprint": "7ed3bda1f4269be57c9310d92f78b18ac506d9f5",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 53
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 10888,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "58773a72cfab371fe59054000f764c49dc7ec23e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 10888,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:10888 \u00b7 (tentative d'exploit)",
"target_port_label": "10888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 53
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10888,
"protocol_emulated": null,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 10888,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:10888 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "10888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri"
]
}
|
|
|
TCP |
10810 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:10810 · (tentative d'exploit)
|
Élevée
|
Moyen · 55
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
10810
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 55
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 10810,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 55,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "24236112231e99ccabc170b3fb454187cf58668b",
"event_fingerprint": "1198e870fcd712e382857d0d471b5b89f429a83c",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 55
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 10810,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "73240c65df8675748b785682fc97eb02538d6e53",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 10810,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:10810 \u00b7 (tentative d'exploit)",
"target_port_label": "10810 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 55
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10810,
"protocol_emulated": null,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 10810,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:10810 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "10810 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10810"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri"
]
}
|
|
|
TCP |
10809 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:10809 · (tentative d'exploit)
|
Élevée
|
Moyen · 55
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
10809
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 55
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 10809,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 55,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "8e6c78ff3d0e76b0d3242ca4022b0d3dcf0772be",
"event_fingerprint": "6913cee4f3b9615a9efeb8f49fdecd9ed694c49b",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 55
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 10809,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c1f148f393fdee536db16203ea8b7ec144eb8374",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 10809,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:10809 \u00b7 (tentative d'exploit)",
"target_port_label": "10809 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 55
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10809,
"protocol_emulated": null,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 10809,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:10809 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "10809 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10809"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri"
]
}
|
|
|
TCP |
10808 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:10808 · (tentative d'exploit)
|
Élevée
|
Moyen · 55
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
10808
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 55
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 10808,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 55,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9710d58291bfc731243de9703975eb5f17e2b05c",
"event_fingerprint": "6e15eb88d2db3a2923cfcf0866484934a0cb6d2a",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 55
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 10808,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0d2ca053e799f18b9bf2f5203a33aa8a14b466a2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 10808,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:10808 \u00b7 (tentative d'exploit)",
"target_port_label": "10808 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 55
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10808,
"protocol_emulated": null,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 10808,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:10808 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "10808 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10808"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri"
]
}
|
|
|
TCP |
10001 · MEMCACHED ALT
|
memcached-alt
|
Botnet Mozi
mozi pattern · via MEMCACHED ALT:10001 · (commande & contrôle)
|
Élevée
|
Faible · 36
|
|
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0011
TA0011
Protocole
Émulateur
MEMCACHED-ALT
WAF
—
Recommandation
Surveiller
Tags
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
10001
Chemin / cible
—
Service
MEMCACHED ALT
Payload
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 36
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0011
Tactiques MITRE
TA0011
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "56455253494f4e20312e362e360d0a",
"emulator_response_len": 15,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "memcached-alt",
"app_proto": "memcached-alt",
"asn": 219502,
"country": "NL",
"dst_port": 10001,
"risk_waf": 8,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 36,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "83ebf3e8a5cba2c6d6f1977c4aa7e1e980d7a716",
"event_fingerprint": "5d393a0db7e2c5a66bd33c9f59feee136ae2f314",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 36
},
"named_classification_skipped": false,
"service_name": "memcached-alt",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "762d384fab941f6d0c2239f19994f30e"
},
"target_context": {
"dst_port": 10001,
"service": "memcached-alt",
"service_name": "memcached-alt",
"risk_score": 36
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "c2",
"mitre_tactics": [
"TA0011"
],
"mitre": "TA0011",
"threat_family": [
"botnet"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2a4d88fa1644ad3e4e6ffe95e81a95696c9d79a4",
"protocol_details": {
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"port": 10001,
"service": "memcached-alt",
"service_label_fr": "MEMCACHED ALT"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "mozi pattern \u00b7 via MEMCACHED ALT:10001 \u00b7 (commande & contr\u00f4le)",
"target_port_label": "10001 \u00b7 MEMCACHED ALT",
"emulator_service": "memcached-alt",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 36\/100 (Faible) \u2014 MITRE TA0011 \u2014 via MEMCACHED ALT",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 36
},
"attack_stage": "c2",
"attack_stage_label": "Commande & contr\u00f4le",
"attack_chain_stage": "command_and_control",
"attack_chain_stage_label_fr": "Commande & contr\u00f4le",
"risk_score": 36,
"risk_label": "Faible",
"service_name": "memcached-alt",
"service_label_fr": "MEMCACHED ALT",
"dst_port": 10001,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0011",
"mitre_technique": "TA0011",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-memcached-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"port": 10001,
"service": "memcached-alt",
"service_label_fr": "MEMCACHED ALT"
},
"attack_vector": "mozi pattern \u00b7 via MEMCACHED ALT:10001 \u00b7 (commande & contr\u00f4le)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "10001 \u00b7 MEMCACHED ALT",
"emulator_service": "memcached-alt",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "stage"
},
{
"key": "command_and_control",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "memcached_alt",
"service_banner": "honeypot-memcached-alt",
"service_os": "linux",
"dst_port": "10001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "command_and_control",
"ban_policy": "advisory_monitor",
"tags_list": [
"mozi_pattern",
"net_mozi_pattern"
]
}
|
|
|
TCP |
10000 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:10000 · (tentative d'exploit)
|
Élevée
|
Moyen · 55
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
10000
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 55
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e",
"emulator_response_len": 126,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 10000,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 55,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "6311be7797eb29129c1f53ec798a7409b3656798",
"event_fingerprint": "b1012fc9cd3736ced13bdb58824fecc09d0e4d89",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 55
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 10000,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "63a175110451744e7cf51f4292ce1687cbc7ecd8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 10000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:10000 \u00b7 (tentative d'exploit)",
"target_port_label": "10000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 55
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10000,
"protocol_emulated": true,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 10000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:10000 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "10000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"net_web_probe"
]
}
|
|
|
TCP |
9999 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:9999 · (tentative d'exploit)
|
Élevée
|
Moyen · 55
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9999
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 55
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 9999,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 55,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "909ffbce896e6827a68d9a2fbf0516d5d19d4d16",
"event_fingerprint": "5c1b873ec4349174162e575198764af025350ad2",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 55
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 9999,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "50c6b17557ef04996be658964a3464585498e7d2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 9999,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:9999 \u00b7 (tentative d'exploit)",
"target_port_label": "9999 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 55
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9999,
"protocol_emulated": true,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 9999,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:9999 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "9999 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9999"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"net_web_probe"
]
}
|
|
|
TCP |
9998 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:9998 · (tentative d'exploit)
|
Élevée
|
Moyen · 54
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9998
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 9998,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 54,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "bd7e734d607d0b0d258462034c12919cc6422244",
"event_fingerprint": "9f401cdff60a9569cd2a39ca4f030c675670377e",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 54
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 9998,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b54e16644cafb8632be5823a3158f789a376b7b2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 9998,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:9998 \u00b7 (tentative d'exploit)",
"target_port_label": "9998 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 54
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9998,
"protocol_emulated": null,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 9998,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:9998 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "9998 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9998"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri"
]
}
|
|
|
TCP |
9444 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:9444 · (tentative d'exploit)
|
Élevée
|
Moyen · 55
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9444
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 55
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 9444,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 55,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "13e5d27e059110a88caf53a0e8dab01d8963883b",
"event_fingerprint": "185cc1002c516857ee2d9a9521d5d4619caeaedd",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 55
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 9444,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5220dad0780d35c6084ba1f9153f8a89f1de4fab",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 9444,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:9444 \u00b7 (tentative d'exploit)",
"target_port_label": "9444 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 55
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9444,
"protocol_emulated": null,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 9444,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:9444 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "9444 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9444"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri"
]
}
|
|
|
TCP |
9200 · ELASTICSEARCH
|
elasticsearch
|
LFI wrapper PHP
lfi php wrapper · via ELASTICSEARCH:9200 · (tentative d'exploit)
|
Élevée
|
Moyen · 57
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / Requête Elasticsearch : http://146.56.180.42:3333/ UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
ELASTICSEARCH
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9200
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 57
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c",
"emulator_response_len": 172,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "elasticsearch",
"app_proto": "elasticsearch",
"asn": 219502,
"country": "NL",
"dst_port": 9200,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 50,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 50,
"novelty": 25
},
"risk_score": 57,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "59accf9df27654494a9d090283b1b0e6caab54f0",
"event_fingerprint": "e3c47dd9b7b82df58f785f8ecdc12ea32d109f12",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 50,
"novelty": 25,
"risk_score": 57
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "elasticsearch",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 9200,
"service": "elasticsearch",
"service_name": "elasticsearch",
"risk_score": 57
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1b3358d13e45a258deee15a449871cce802a2bbd",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : http:\/\/146.56.180.42:3333\/",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via ELASTICSEARCH:9200 \u00b7 (tentative d'exploit)",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via ELASTICSEARCH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 50,
"novelty": 25,
"risk_score": 57
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 57,
"risk_label": "Moyen",
"service_name": "elasticsearch",
"service_label_fr": "ELASTICSEARCH",
"dst_port": 9200,
"protocol_emulated": true,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Elasticsearch 8.11",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : http:\/\/146.56.180.42:3333\/",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"attack_vector": "lfi php wrapper \u00b7 via ELASTICSEARCH:9200 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "elasticsearch",
"service_banner": "Elasticsearch 8.11",
"service_os": "linux",
"dst_port": "9200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"net_elasticsearch_probe"
]
}
|
|
|
TCP |
9098 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:9098 · (tentative d'exploit)
|
Élevée
|
Moyen · 54
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9098
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 9098,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 54,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "5eb49766a97ce853e362e81f373d2ed9346353fa",
"event_fingerprint": "79ca86b8579ba1885111ae1ab139d5dd6e5dde39",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 54
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 9098,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "13aaaef33f09cb6bad228ddf250a7c715fa788b2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 9098,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:9098 \u00b7 (tentative d'exploit)",
"target_port_label": "9098 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 54
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9098,
"protocol_emulated": null,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 9098,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:9098 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "9098 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri"
]
}
|
|
|
TCP |
9095 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:9095 · (tentative d'exploit)
|
Élevée
|
Moyen · 54
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9095
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 9095,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 54,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d67563b42936bbb1070c5212ddd13614b5febbfa",
"event_fingerprint": "d3a0cc419e855b738de1e015f233426e8c7b7b9f",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 54
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 9095,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c4e2830d2e7adbd3091236e7bf3ec0fdb197516f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 9095,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:9095 \u00b7 (tentative d'exploit)",
"target_port_label": "9095 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 54
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9095,
"protocol_emulated": null,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 9095,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:9095 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "9095 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9095"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri"
]
}
|
|
|
TCP |
9093 · KAFKA CONTROLLER
|
kafka-controller
|
Botnet Mozi
mozi pattern · via KAFKA CONTROLLER:9093 · (commande & contrôle)
|
Élevée
|
Faible · 36
|
|
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0011
TA0011
Protocole
Émulateur
KAFKA-CONTROLLER
WAF
—
Recommandation
Surveiller
Tags
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9093
Chemin / cible
—
Service
KAFKA CONTROLLER
Payload
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 36
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0011
Tactiques MITRE
TA0011
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206b61666b615f636f6e74726f6c6c657220726561647920706f72743d393039330d0a",
"emulator_response_len": 47,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "kafka-controller",
"app_proto": "kafka-controller",
"asn": 219502,
"country": "NL",
"dst_port": 9093,
"risk_waf": 8,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 36,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "bc506c5ae586b69e42c2c63a778317653530392f",
"event_fingerprint": "6a387fe1f46a5b5fc49adc452ec81927df9a3c74",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 36
},
"named_classification_skipped": false,
"service_name": "kafka-controller",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "762d384fab941f6d0c2239f19994f30e"
},
"target_context": {
"dst_port": 9093,
"service": "kafka-controller",
"service_name": "kafka-controller",
"risk_score": 36
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "c2",
"mitre_tactics": [
"TA0011"
],
"mitre": "TA0011",
"threat_family": [
"botnet"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b7262938b86e9716d108679adc658ad285b632ae",
"protocol_details": {
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"port": 9093,
"service": "kafka-controller",
"service_label_fr": "KAFKA CONTROLLER"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "mozi pattern \u00b7 via KAFKA CONTROLLER:9093 \u00b7 (commande & contr\u00f4le)",
"target_port_label": "9093 \u00b7 KAFKA CONTROLLER",
"emulator_service": "kafka-controller",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 36\/100 (Faible) \u2014 MITRE TA0011 \u2014 via KAFKA CONTROLLER",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 36
},
"attack_stage": "c2",
"attack_stage_label": "Commande & contr\u00f4le",
"attack_chain_stage": "command_and_control",
"attack_chain_stage_label_fr": "Commande & contr\u00f4le",
"risk_score": 36,
"risk_label": "Faible",
"service_name": "kafka-controller",
"service_label_fr": "KAFKA CONTROLLER",
"dst_port": 9093,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0011",
"mitre_technique": "TA0011",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kafka-controller",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"port": 9093,
"service": "kafka-controller",
"service_label_fr": "KAFKA CONTROLLER"
},
"attack_vector": "mozi pattern \u00b7 via KAFKA CONTROLLER:9093 \u00b7 (commande & contr\u00f4le)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "9093 \u00b7 KAFKA CONTROLLER",
"emulator_service": "kafka-controller",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "stage"
},
{
"key": "command_and_control",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kafka_controller",
"service_banner": "honeypot-kafka-controller",
"service_os": "linux",
"dst_port": "9093"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "command_and_control",
"ban_policy": "advisory_monitor",
"tags_list": [
"mozi_pattern",
"net_mozi_pattern"
]
}
|
|
|
TCP |
9092 · KAFKA
|
kafka
|
Sonde Kafka
kafka probe · via KAFKA:9092 · (sonde / probe)
|
Élevée
|
Faible · 29
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KAFKA
WAF
—
Recommandation
Surveiller
Tags
kafka_api_versions
kafka_emulated
mozi_pattern
net_kafka_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9092
Chemin / cible
—
Service
KAFKA
Payload
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 29
Confiance : Confiance 0 % — 4 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0000000c6874747000000001000b0000",
"emulator_response_len": 16,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "kafka",
"app_proto": "kafka",
"asn": 219502,
"country": "NL",
"dst_port": 9092,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 29,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "e01b552454505be503d90db40228a654afb5a89b",
"event_fingerprint": "c474d9c3f8c0776c7c96d4f25d2b0651552d8fad",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 29
},
"named_classification_skipped": false,
"service_name": "kafka",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
},
"target_context": {
"dst_port": 9092,
"service": "kafka",
"service_name": "kafka",
"risk_score": 29
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "81720e3e3123c1efc99b5d0008e724b23944ff17",
"protocol_details": {
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"port": 9092,
"service": "kafka",
"service_label_fr": "KAFKA"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "kafka probe \u00b7 via KAFKA:9092 \u00b7 (sonde \/ probe)",
"target_port_label": "9092 \u00b7 KAFKA",
"emulator_service": "kafka",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 29
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 29,
"risk_label": "Faible",
"service_name": "kafka",
"service_label_fr": "KAFKA",
"dst_port": 9092,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kafka",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"port": 9092,
"service": "kafka",
"service_label_fr": "KAFKA"
},
"attack_vector": "kafka probe \u00b7 via KAFKA:9092 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "9092 \u00b7 KAFKA",
"emulator_service": "kafka",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kafka",
"service_banner": "honeypot-kafka",
"service_os": "linux",
"dst_port": "9092"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"kafka_api_versions",
"kafka_emulated",
"mozi_pattern",
"net_kafka_probe"
]
}
|
|
|
TCP |
9091 · KAFKA JMX
|
kafka-jmx
|
Botnet Mozi
mozi pattern · via KAFKA JMX:9091 · (commande & contrôle)
|
Élevée
|
Faible · 36
|
|
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0011
TA0011
Protocole
Émulateur
KAFKA-JMX
WAF
—
Recommandation
Surveiller
Tags
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9091
Chemin / cible
—
Service
KAFKA JMX
Payload
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 36
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0011
Tactiques MITRE
TA0011
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206b61666b615f6a6d7820726561647920706f72743d393039310d0a",
"emulator_response_len": 40,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "kafka-jmx",
"app_proto": "kafka-jmx",
"asn": 219502,
"country": "NL",
"dst_port": 9091,
"risk_waf": 8,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 36,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "8285524097faf336ade37e814a5f2e86d0864867",
"event_fingerprint": "971ef2e8331e408f981a3d06d9f2f0499dd5d0ba",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 36
},
"named_classification_skipped": false,
"service_name": "kafka-jmx",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "762d384fab941f6d0c2239f19994f30e"
},
"target_context": {
"dst_port": 9091,
"service": "kafka-jmx",
"service_name": "kafka-jmx",
"risk_score": 36
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "c2",
"mitre_tactics": [
"TA0011"
],
"mitre": "TA0011",
"threat_family": [
"botnet"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b5e0c21730226bd8e4d4df4f681c5aeefbb351bc",
"protocol_details": {
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"port": 9091,
"service": "kafka-jmx",
"service_label_fr": "KAFKA JMX"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "mozi pattern \u00b7 via KAFKA JMX:9091 \u00b7 (commande & contr\u00f4le)",
"target_port_label": "9091 \u00b7 KAFKA JMX",
"emulator_service": "kafka-jmx",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 36\/100 (Faible) \u2014 MITRE TA0011 \u2014 via KAFKA JMX",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 36
},
"attack_stage": "c2",
"attack_stage_label": "Commande & contr\u00f4le",
"attack_chain_stage": "command_and_control",
"attack_chain_stage_label_fr": "Commande & contr\u00f4le",
"risk_score": 36,
"risk_label": "Faible",
"service_name": "kafka-jmx",
"service_label_fr": "KAFKA JMX",
"dst_port": 9091,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0011",
"mitre_technique": "TA0011",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kafka-jmx",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"port": 9091,
"service": "kafka-jmx",
"service_label_fr": "KAFKA JMX"
},
"attack_vector": "mozi pattern \u00b7 via KAFKA JMX:9091 \u00b7 (commande & contr\u00f4le)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "9091 \u00b7 KAFKA JMX",
"emulator_service": "kafka-jmx",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "stage"
},
{
"key": "command_and_control",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kafka_jmx",
"service_banner": "honeypot-kafka-jmx",
"service_os": "linux",
"dst_port": "9091"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "command_and_control",
"ban_policy": "advisory_monitor",
"tags_list": [
"mozi_pattern",
"net_mozi_pattern"
]
}
|
|
|
TCP |
9090 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:9090 · (tentative d'exploit)
|
Élevée
|
Moyen · 54
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9090
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a20746578742f706c61696e3b2076657273696f6e3d302e302e340d0a436f6e74656e742d4c656e6774683a2036360d0a0d0a232048454c502075702031206966207461726765742069732075702e0a2320545950452075702067617567650a75707b",
"emulator_response_len": 146,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 9090,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 54,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "1ffa498ef759401d14a0f170b28692ad943c3d48",
"event_fingerprint": "68607a64961be6dfc822cd758507df8611963678",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 54
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 9090,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8698435d1576c7b51629e1c6223678f709894d2b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 9090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:9090 \u00b7 (tentative d'exploit)",
"target_port_label": "9090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 54
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9090,
"protocol_emulated": true,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 9090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:9090 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "9090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"net_web_probe"
]
}
|
|
|
TCP |
9081 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:9081 · (tentative d'exploit)
|
Élevée
|
Moyen · 56
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9081
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 56
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 9081,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 56,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "b9b1bc76c758f6be3483e5f933c0aea7ae5e5d30",
"event_fingerprint": "0595ba0b44e8ca5e690dc6d0485de59d533d0791",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 56
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 9081,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d47b7a7e57c45c4ca4d810a1c5b90b234ef4a20d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 9081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:9081 \u00b7 (tentative d'exploit)",
"target_port_label": "9081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 56
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9081,
"protocol_emulated": null,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 9081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:9081 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "9081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri"
]
}
|
|
|
TCP |
9080 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:9080 · (tentative d'exploit)
|
Élevée
|
Moyen · 57
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9080
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 57
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053",
"emulator_response_len": 147,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 9080,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 57,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f0773aabd0dab6de0a8f7bf7b035262b831be99f",
"event_fingerprint": "c636809ca568b4c3936837e2c7136e57ebc41d14",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 57
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 9080,
"service": "http",
"service_name": "http",
"risk_score": 57
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7c9f258e7a25ddd637588f9f22fc5ac4b1a3e4ec",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 9080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:9080 \u00b7 (tentative d'exploit)",
"target_port_label": "9080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 57
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 57,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9080,
"protocol_emulated": true,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 9080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:9080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "9080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"net_web_probe"
]
}
|
|
|
TCP |
9060 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:9060 · (tentative d'exploit)
|
Élevée
|
Moyen · 53
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9060
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 53
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 9060,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.7,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 53,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "764f79636a16de11e592688eee22256e0c237234",
"event_fingerprint": "44a2b215dce7c119b32dd9fa349b37ac10aed473",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 53
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 9060,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "093abd3e58cc78ec36539bcee4f98c61c44dae87",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 9060,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:9060 \u00b7 (tentative d'exploit)",
"target_port_label": "9060 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 53
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9060,
"protocol_emulated": null,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 9060,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:9060 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "9060 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9060"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri"
]
}
|
|
|
TCP |
9050 · TOR SOCKS
|
tor-socks
|
Botnet Mozi
mozi pattern · via TOR SOCKS:9050 · (commande & contrôle)
|
Élevée
|
Faible · 38
|
|
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0011
TA0011
Protocole
Émulateur
TOR-SOCKS
WAF
—
Recommandation
Surveiller
Tags
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9050
Chemin / cible
—
Service
TOR SOCKS
Payload
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 38
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0011
Tactiques MITRE
TA0011
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f7420746f725f736f636b7320726561647920706f72743d393035300d0a",
"emulator_response_len": 40,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "tor-socks",
"app_proto": "tor-socks",
"asn": 219502,
"country": "NL",
"dst_port": 9050,
"risk_waf": 8,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 38,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "b1ada5efceffa1e87a9da9e8f9e347363c0ff8e1",
"event_fingerprint": "83b7d2a8aa1dd392390bb8533ec0659ebf12f22c",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 38
},
"named_classification_skipped": false,
"service_name": "tor-socks",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "762d384fab941f6d0c2239f19994f30e"
},
"target_context": {
"dst_port": 9050,
"service": "tor-socks",
"service_name": "tor-socks",
"risk_score": 38
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "c2",
"mitre_tactics": [
"TA0011"
],
"mitre": "TA0011",
"threat_family": [
"botnet"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "98ca894ce52e34ec653d28d51066c8afcb207e86",
"protocol_details": {
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"port": 9050,
"service": "tor-socks",
"service_label_fr": "TOR SOCKS"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "mozi pattern \u00b7 via TOR SOCKS:9050 \u00b7 (commande & contr\u00f4le)",
"target_port_label": "9050 \u00b7 TOR SOCKS",
"emulator_service": "tor-socks",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 38\/100 (Faible) \u2014 MITRE TA0011 \u2014 via TOR SOCKS",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 38
},
"attack_stage": "c2",
"attack_stage_label": "Commande & contr\u00f4le",
"attack_chain_stage": "command_and_control",
"attack_chain_stage_label_fr": "Commande & contr\u00f4le",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "tor-socks",
"service_label_fr": "TOR SOCKS",
"dst_port": 9050,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0011",
"mitre_technique": "TA0011",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tor-socks",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"port": 9050,
"service": "tor-socks",
"service_label_fr": "TOR SOCKS"
},
"attack_vector": "mozi pattern \u00b7 via TOR SOCKS:9050 \u00b7 (commande & contr\u00f4le)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "9050 \u00b7 TOR SOCKS",
"emulator_service": "tor-socks",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "stage"
},
{
"key": "command_and_control",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tor_socks",
"service_banner": "honeypot-tor-socks",
"service_os": "linux",
"dst_port": "9050"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "command_and_control",
"ban_policy": "advisory_monitor",
"tags_list": [
"mozi_pattern",
"net_mozi_pattern"
]
}
|
|
|
TCP |
9050 · TOR SOCKS
|
tor-socks
|
proxy probe
proxy probe · via TOR SOCKS:9050 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
TOR-SOCKS
WAF
—
Recommandation
Surveiller
Tags
net_proxy_probe
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9050
Chemin / cible
—
Service
TOR SOCKS
Payload
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f7420746f725f736f636b7320726561647920706f72743d393035300d0a",
"emulator_response_len": 40,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "tor-socks",
"app_proto": "tor-socks",
"asn": 219502,
"country": "NL",
"dst_port": 9050,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "72e4059e33cab113c88cac5ca4ddcf8f32c831bf",
"event_fingerprint": "4b9b41cd39d21d8f42e99dfe49afb74032e8a6b4",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35
},
"service_name": "tor-socks",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 9050,
"service": "tor-socks",
"service_name": "tor-socks",
"risk_score": 35
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5b2f86efd33d099c36d9f6f276cfa58cdf170589",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 9050,
"service": "tor-socks",
"service_label_fr": "TOR SOCKS"
},
"attack_vector": "proxy probe \u00b7 via TOR SOCKS:9050 \u00b7 (sonde \/ probe)",
"target_port_label": "9050 \u00b7 TOR SOCKS",
"emulator_service": "tor-socks",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tor-socks",
"service_label_fr": "TOR SOCKS",
"dst_port": 9050,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tor-socks",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 9050,
"service": "tor-socks",
"service_label_fr": "TOR SOCKS"
},
"attack_vector": "proxy probe \u00b7 via TOR SOCKS:9050 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "9050 \u00b7 TOR SOCKS",
"emulator_service": "tor-socks",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tor_socks",
"service_banner": "honeypot-tor-socks",
"service_os": "linux",
"dst_port": "9050"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_proxy_probe",
"socks5_greeting"
]
}
|
|
|
TCP |
9040 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:9040 · (tentative d'exploit)
|
Élevée
|
Moyen · 55
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9040
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 55
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 9040,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 55,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "6bf2d63631b8791e5c5923ee3b0d014033812168",
"event_fingerprint": "615225dca70938c0a39d9e09c1a00d7030042f72",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 55
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 9040,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b00358cd469dce61001127fc82d5687c1014413",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 9040,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:9040 \u00b7 (tentative d'exploit)",
"target_port_label": "9040 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 55
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9040,
"protocol_emulated": null,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 9040,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:9040 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "9040 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9040"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri"
]
}
|
|
|
TCP |
9011 · Webhook GitHub
|
github-webhook
|
github webhook abuse
github webhook abuse · via Webhook GitHub:9011 · (tentative d'exploit)
|
Élevée
|
Faible · 34
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
GITHUB-WEBHOOK
WAF
—
Recommandation
Surveiller
Tags
github_webhook_emulated
mozi_pattern
net_github_webhook_abuse
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9011
Chemin / cible
—
Service
Webhook GitHub
Payload
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Pourquoi cette classification : Type « github_webhook_abuse » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206769746875625f776562686f6f6b20726561647920706f72743d393031310d0a",
"emulator_response_len": 45,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "github-webhook",
"app_proto": "github-webhook",
"asn": 219502,
"country": "NL",
"dst_port": 9011,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 34,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "13f8fedd1df65cfb9a82ea51ed1f71f36b30a1ad",
"event_fingerprint": "b3ad9468cd1d938826d29a60b9f87fd9a0b3eaaa",
"classification_reason": "Type \u00ab github_webhook_abuse \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "github-webhook",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "3a1138cde939a3dbf37a222ea59ef72a"
},
"target_context": {
"dst_port": 9011,
"service": "github-webhook",
"service_name": "github-webhook",
"risk_score": 34
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab github_webhook_abuse \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d951bd49c4729d8f3e184685a4c51fba0b164d7d",
"protocol_details": {
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "github webhook abuse \u00b7 via Webhook GitHub:9011 \u00b7 (tentative d'exploit)",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab github_webhook_abuse \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab github_webhook_abuse \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 34\/100 (Faible) \u2014 MITRE TA0001 \u2014 via Webhook GitHub",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 34
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "github-webhook",
"service_label_fr": "Webhook GitHub",
"dst_port": 9011,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-github-webhook",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"port": 9011,
"service": "github-webhook",
"service_label_fr": "Webhook GitHub"
},
"attack_vector": "github webhook abuse \u00b7 via Webhook GitHub:9011 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "9011 \u00b7 Webhook GitHub",
"emulator_service": "github-webhook",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "github_webhook",
"service_banner": "honeypot-github-webhook",
"service_os": "linux",
"dst_port": "9011"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"github_webhook_emulated",
"mozi_pattern",
"net_github_webhook_abuse"
]
}
|
|
|
TCP |
9010 · Webhook Discord
|
discord-webhook
|
discord webhook abuse
discord webhook abuse · via Webhook Discord:9010 · (tentative d'exploit)
|
Élevée
|
Faible · 34
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
DISCORD-WEBHOOK
WAF
—
Recommandation
Surveiller
Tags
discord_webhook_emulated
mozi_pattern
net_discord_webhook_abuse
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9010
Chemin / cible
—
Service
Webhook Discord
Payload
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Pourquoi cette classification : Type « discord_webhook_abuse » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f7420646973636f72645f776562686f6f6b20726561647920706f72743d393031300d0a",
"emulator_response_len": 46,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "discord-webhook",
"app_proto": "discord-webhook",
"asn": 219502,
"country": "NL",
"dst_port": 9010,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 34,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d99d75c30869239d08f5a67c9b10ba0c1cea08d9",
"event_fingerprint": "2a6c80a04d61966fe8e01583789690745c7f305d",
"classification_reason": "Type \u00ab discord_webhook_abuse \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "discord-webhook",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "d660de731b44d608719f6d1a3051f13e"
},
"target_context": {
"dst_port": 9010,
"service": "discord-webhook",
"service_name": "discord-webhook",
"risk_score": 34
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab discord_webhook_abuse \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9e81a31016a426ff28d8a8974f7faced797d7d11",
"protocol_details": {
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"port": 9010,
"service": "discord-webhook",
"service_label_fr": "Webhook Discord"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "discord webhook abuse \u00b7 via Webhook Discord:9010 \u00b7 (tentative d'exploit)",
"target_port_label": "9010 \u00b7 Webhook Discord",
"emulator_service": "discord-webhook",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab discord_webhook_abuse \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab discord_webhook_abuse \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 34\/100 (Faible) \u2014 MITRE TA0001 \u2014 via Webhook Discord",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 34
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "discord-webhook",
"service_label_fr": "Webhook Discord",
"dst_port": 9010,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-discord-webhook",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"port": 9010,
"service": "discord-webhook",
"service_label_fr": "Webhook Discord"
},
"attack_vector": "discord webhook abuse \u00b7 via Webhook Discord:9010 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "9010 \u00b7 Webhook Discord",
"emulator_service": "discord-webhook",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "discord_webhook",
"service_banner": "honeypot-discord-webhook",
"service_os": "linux",
"dst_port": "9010"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"discord_webhook_emulated",
"mozi_pattern",
"net_discord_webhook_abuse"
]
}
|
|
|
TCP |
9008 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:9008 · (tentative d'exploit)
|
Élevée
|
Moyen · 54
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9008
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 9008,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 54,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "a24182faa51e148cd6aead88a687811ccf6ea412",
"event_fingerprint": "a56e4b3c718f344f2d7a18561cb6f577ecb89bb2",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 54
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 9008,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "331dc5b0c06bd5be60d33289d15990e5a007ee22",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 9008,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:9008 \u00b7 (tentative d'exploit)",
"target_port_label": "9008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 54
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9008,
"protocol_emulated": null,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 9008,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:9008 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "9008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9008"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri"
]
}
|
|
|
TCP |
9003 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:9003 · (tentative d'exploit)
|
Élevée
|
Moyen · 54
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9003
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 9003,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 54,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ba58de24568567db85a76ae0a6cd7970d2a9b6de",
"event_fingerprint": "c77ccedae28dd7ee49ac0146bbc52f795f892acb",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 54
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 9003,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d20c7fe31c7d55d98b2eae66c3cea1dd53936ba5",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 9003,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:9003 \u00b7 (tentative d'exploit)",
"target_port_label": "9003 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 54
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9003,
"protocol_emulated": null,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 9003,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:9003 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "9003 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9003"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri"
]
}
|
|
|
TCP |
9002 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:9002 · (tentative d'exploit)
|
Élevée
|
Moyen · 54
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9002
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 9002,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 54,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "7899e52aeae705582e43cb4c7fb3a8b3c314f4b7",
"event_fingerprint": "6ec9dd34bbfa877a0175e730d616e0936b2bcf5b",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 54
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 9002,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9dfbc047e9de9ad77966121d1e7978d6df13ba78",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 9002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:9002 \u00b7 (tentative d'exploit)",
"target_port_label": "9002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 54
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9002,
"protocol_emulated": true,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 9002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:9002 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "9002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"net_web_probe"
]
}
|
|
|
TCP |
9001 · TOR OR
|
tor-or
|
tor exit probe
tor exit probe · via TOR OR:9001 · (commande & contrôle)
|
Élevée
|
Moyen · 42
|
|
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0011
TA0011
Protocole
Émulateur
TOR-OR
WAF
—
Recommandation
Surveiller
Tags
mozi_pattern
net_tor_probe
tor_exit_probe
tor_or_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9001
Chemin / cible
—
Service
TOR OR
Payload
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Pourquoi cette classification : Type « tor_exit_probe » (signaux protocolaires) · confiance 46%
Confiance classification
46%
Confiance modérée — signal unique
Risque capteur
Moyen
· 42
Confiance : Confiance 46 % — 5 signal(aux) capteur
Protocole émulé
1
Signaux
Tor Exit Hint
Technique MITRE
TA0011
Tactiques MITRE
TA0011
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "030000000000000000",
"emulator_response_len": 9,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "tor-or",
"app_proto": "tor-or",
"asn": 219502,
"country": "NL",
"dst_port": 9001,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "a17b1a16d360e7d2518ecdc9dee319ab1bc8f78e",
"event_fingerprint": "2bc74a66a243c40126697f519e65200a159d147e",
"classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%",
"confidence": 0.46,
"classification_confidence": 0.46,
"precision_score": 55,
"precision_signals": [
"INT-TOR-exit-hint"
],
"kb_rule_ids": [
"INT-TOR-exit-hint"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25,
"risk_score": 42
},
"named_classification_skipped": false,
"service_name": "tor-or",
"risk_confidence_factor": 46,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "d2d40d620e587c49ef0af866b893b1d5"
},
"target_context": {
"dst_port": 9001,
"service": "tor-or",
"service_name": "tor-or",
"risk_score": 42
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%"
},
"attack_stage": "c2",
"mitre_tactics": [
"TA0011"
],
"mitre": "TA0011",
"threat_family": [
"botnet"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "28d413b05c4366bb7a9dcd779a5bacdeaedf1fc5",
"protocol_details": {
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"port": 9001,
"service": "tor-or",
"service_label_fr": "TOR OR"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "tor exit probe \u00b7 via TOR OR:9001 \u00b7 (commande & contr\u00f4le)",
"target_port_label": "9001 \u00b7 TOR OR",
"emulator_service": "tor-or",
"confidence_reason": "Confiance 46 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%",
"classification_reason_label_fr": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE TA0011 \u2014 confiance 46 % \u2014 via TOR OR",
"confidence_pct": 46,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25,
"risk_score": 42
},
"attack_stage": "c2",
"attack_stage_label": "Commande & contr\u00f4le",
"attack_chain_stage": "command_and_control",
"attack_chain_stage_label_fr": "Commande & contr\u00f4le",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tor-or",
"service_label_fr": "TOR OR",
"dst_port": 9001,
"protocol_emulated": true,
"tags_summary": [
"INT-TOR-exit-hint"
],
"tags_summary_labels_fr": [
"Tor Exit Hint"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0011",
"mitre_technique": "TA0011",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tor-or",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"port": 9001,
"service": "tor-or",
"service_label_fr": "TOR OR"
},
"attack_vector": "tor exit probe \u00b7 via TOR OR:9001 \u00b7 (commande & contr\u00f4le)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "9001 \u00b7 TOR OR",
"emulator_service": "tor-or",
"confidence_reason": "Confiance 46 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": "Confiance 46 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "stage"
},
{
"key": "command_and_control",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tor_or",
"service_banner": "honeypot-tor-or",
"service_os": "linux",
"dst_port": "9001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "command_and_control",
"ban_policy": "advisory_monitor",
"tags_list": [
"mozi_pattern",
"net_tor_probe",
"tor_exit_probe",
"tor_or_emulated",
"tor_or_payload"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
9000 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:9000 · (tentative d'exploit)
|
Élevée
|
Moyen · 54
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9000
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 9000,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 54,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "6191062c1b14f64968c1f0044dfe8145c37ac81b",
"event_fingerprint": "612d080f0a092a26d4ba5a51639d710fd52d67fd",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 54
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 9000,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8b7e9ed691a1caa79e2ff4de6dbe9874a001d2f7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 9000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:9000 \u00b7 (tentative d'exploit)",
"target_port_label": "9000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 54
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9000,
"protocol_emulated": true,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 9000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:9000 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "9000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"net_web_probe"
]
}
|
|
|
TCP |
8989 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:8989 · (tentative d'exploit)
|
Élevée
|
Moyen · 56
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8989
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 56
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 8989,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 56,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "1ef86d9d4b4c0c9899547d4f2b049e3f7e09961a",
"event_fingerprint": "6453d385fe6ec00ab8b5d0d2f2518aa60822d4a0",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 56
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 8989,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "49a568cb7182d2deaa9b12bef3971bf8a74952f6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 8989,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:8989 \u00b7 (tentative d'exploit)",
"target_port_label": "8989 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 56
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8989,
"protocol_emulated": null,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 8989,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:8989 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "8989 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8989"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri"
]
}
|
|
|
TCP |
8899 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:8899 · (tentative d'exploit)
|
Élevée
|
Moyen · 53
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8899
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 53
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 8899,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 53,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "490132f6196ea5283780d130270024e2472b0621",
"event_fingerprint": "2dcea5242040a7af0b608b27edc6a0747c5e6b49",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 53
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 8899,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dc75f2802efc4d1532d201764e3a582e0597c4f2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 8899,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:8899 \u00b7 (tentative d'exploit)",
"target_port_label": "8899 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 53
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8899,
"protocol_emulated": null,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 8899,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:8899 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "8899 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8899"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri"
]
}
|
|
|
TCP |
8888 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:8888 · (tentative d'exploit)
|
Élevée
|
Moyen · 56
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8888
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 56
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
HTTP alt 8888 probe
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 8888,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 56,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9f8f2cb59e83cdba491abde855261d24116a05cb",
"event_fingerprint": "799f8169a269524ed24d2e68c2d42663912beeda",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103",
"pat-0599"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass",
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0088",
"pat-0103",
"pat-0599"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 56
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 8888,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "035993779101d0171e83d9f8c72938b3b9d26c70",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:8888 \u00b7 (tentative d'exploit)",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 56
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8888,
"protocol_emulated": true,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:8888 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"net_web_probe"
]
}
|
|
|
TCP |
8887 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:8887 · (tentative d'exploit)
|
Élevée
|
Moyen · 55
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8887
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 55
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 8887,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 55,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "8f08ca0a56a13d854271d44adb2cc20955d8452b",
"event_fingerprint": "79904c89925ced788a01e9a682b7d8362f47496b",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 55
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 8887,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3df5ce542e7a64085d78b68bcae5ad0c92364ab7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 8887,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:8887 \u00b7 (tentative d'exploit)",
"target_port_label": "8887 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 55
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8887,
"protocol_emulated": null,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 8887,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:8887 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "8887 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8887"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri"
]
}
|
|
|
TCP |
8886 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:8886 · (tentative d'exploit)
|
Élevée
|
Moyen · 55
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8886
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 55
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 8886,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 55,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9465e9fb0addc2a724227fe562b357f6b0b4e253",
"event_fingerprint": "fb6683d079468ae7f9cde8300ae116e02480157c",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 55
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 8886,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0fe80b84b795cc472d85d81d3b08cd03b6e87cc6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 8886,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:8886 \u00b7 (tentative d'exploit)",
"target_port_label": "8886 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 55
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8886,
"protocol_emulated": null,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 8886,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:8886 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "8886 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8886"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri"
]
}
|
|
|
TCP |
8885 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:8885 · (tentative d'exploit)
|
Élevée
|
Moyen · 55
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8885
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 55
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 8885,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 55,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "2d1438e554498ea6a5c64dfbeb32b7b04267b612",
"event_fingerprint": "391524c220b5f5ea4b44637fecbec534e2af5a78",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 55
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 8885,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d7e276e3541b93631ddd6c42ac01f16cd17b032c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 8885,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:8885 \u00b7 (tentative d'exploit)",
"target_port_label": "8885 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 55
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8885,
"protocol_emulated": null,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 8885,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:8885 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "8885 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8885"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri"
]
}
|
|
|
TCP |
8883 · MQTTS
|
mqtts
|
mqtt probe
mqtt probe · via MQTTS:8883 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MQTTS
WAF
—
Recommandation
Surveiller
Tags
mozi_pattern
mqtts_emulated
mqtts_payload
net_mqtt_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8883
Chemin / cible
—
Service
MQTTS
Payload
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Pourquoi cette classification : Type « mqtt_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 4 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "mqtts",
"app_proto": "mqtts",
"asn": 219502,
"country": "NL",
"dst_port": 8883,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 34,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "28665ff08ebb7cfb8513af2c84b168f90ecbec8a",
"event_fingerprint": "5f7b059db7e7baf96b44a473308871c1ef92cf07",
"classification_reason": "Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "mqtts",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "4449b927317468afa12a2f935a413459"
},
"target_context": {
"dst_port": 8883,
"service": "mqtts",
"service_name": "mqtts",
"risk_score": 34
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "07706d7f63cca5e16a05b0d23a93e389b2e65e00",
"protocol_details": {
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"port": 8883,
"service": "mqtts",
"service_label_fr": "MQTTS"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "mqtt probe \u00b7 via MQTTS:8883 \u00b7 (sonde \/ probe)",
"target_port_label": "8883 \u00b7 MQTTS",
"emulator_service": "mqtts",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "mqtts",
"service_label_fr": "MQTTS",
"dst_port": 8883,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mqtts",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"port": 8883,
"service": "mqtts",
"service_label_fr": "MQTTS"
},
"attack_vector": "mqtt probe \u00b7 via MQTTS:8883 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "8883 \u00b7 MQTTS",
"emulator_service": "mqtts",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mqtts",
"service_banner": "honeypot-mqtts",
"service_os": "linux",
"dst_port": "8883"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mozi_pattern",
"mqtts_emulated",
"mqtts_payload",
"net_mqtt_probe"
]
}
|
|
|
TCP |
8882 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:8882 · (tentative d'exploit)
|
Élevée
|
Moyen · 54
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8882
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 8882,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 54,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "a71eeebe06d7761bf3548c3a81edcf61b52d1779",
"event_fingerprint": "0226d2896ec60299da7c6ba349be7f7f71015fb6",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 54
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 8882,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d6026fa4d179bc36f6f44cbd282391493665b856",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 8882,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:8882 \u00b7 (tentative d'exploit)",
"target_port_label": "8882 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 54
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8882,
"protocol_emulated": null,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 8882,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:8882 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "8882 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8882"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri"
]
}
|
|
|
TCP |
8881 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:8881 · (tentative d'exploit)
|
Élevée
|
Moyen · 54
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8881
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 8881,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 54,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "0631c1cb451dbc6a1a5f2e8de4a8bf842ede17d8",
"event_fingerprint": "5165748e71e4d3991497801bd8e9198cd5b650d9",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 54
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 8881,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "43cedc0ae7cbe20ecb60710765419f0c083b450b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 8881,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:8881 \u00b7 (tentative d'exploit)",
"target_port_label": "8881 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 54
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8881,
"protocol_emulated": null,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 8881,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:8881 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "8881 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8881"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri"
]
}
|
|
|
TCP |
8880 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:8880 · (tentative d'exploit)
|
Élevée
|
Moyen · 55
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8880
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 55
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 8880,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 55,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "2f658e087a1d0ec876a7ae32841fc16e1f2b02a2",
"event_fingerprint": "773241104347e75e38cbb53b4bca8bf09863ef0b",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 55
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 8880,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "38f96b6c968b1471780499c5994392e12346c3f4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 8880,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:8880 \u00b7 (tentative d'exploit)",
"target_port_label": "8880 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 55
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8880,
"protocol_emulated": true,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 8880,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:8880 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "8880 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8880"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"net_web_probe"
]
}
|
|
|
TCP |
8866 · HTTP
|
http
|
LFI wrapper PHP
lfi php wrapper · via HTTP:8866 · (tentative d'exploit)
|
Élevée
|
Moyen · 53
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_absolute_uri
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8866
Chemin / cible
/
Pourquoi cette classification : Type « lfi_php_wrapper » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 53
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0088
pat-0103
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 931100
LFI Double-dot bypass
Ligne de requête
GET http://146.56.180.42:3333/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1
Host: 146.56.180.42:3333
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET http://146.56.180.42:3333/ HTTP/1.1 Host: 146.56.180.42:3333 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: */* Connection: close Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5002ada1c05fac60ce2af638d5f54066641d121c",
"http_host_hash": "f3319d01fc77637a165edf73d37019b576860ff1",
"http_target_hash": "74b5e1596dbc476fbb17df28e2493104a108e0aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 198,
"payload_entropy": 5.215744906159282,
"port_category": "registered",
"org": "Storm Industries LLC",
"service": "http",
"app_proto": "http",
"asn": 219502,
"country": "NL",
"dst_port": 8866,
"risk_waf": 72,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 53,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "024cfce7f23b2009601585f05f2908f97a46a328",
"event_fingerprint": "024dc9e0d16231599fc686415b3fe61d074596b8",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 136,
"precision_signals": [
"pat-0088",
"pat-0103"
],
"kb_rule_ids": [
"pat-0088",
"pat-0103"
],
"matched_patterns": [
"pat-0088",
"pat-0103"
],
"matched_pattern_names": [
"CRS 931100",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0088",
"pat-0103"
],
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 53
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 219502,
"org": "Storm Industries LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "63279522febcf5538b72996c16a8660f",
"payload_hash": "3b1265ad8082238f3c608ec3ac053893",
"path_pattern_hash": "0dcd9bfbc2ee3db7a55cce5999240db1"
},
"target_context": {
"dst_port": 8866,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"request_sample": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083",
"T1190"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "50524058371dcf34b03d4f586d5b2caaaf71b952",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 8866,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "lfi php wrapper \u00b7 via HTTP:8866 \u00b7 (tentative d'exploit)",
"target_port_label": "8866 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_php_wrapper \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 53
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8866,
"protocol_emulated": null,
"tags_summary": [
"pat-0088",
"pat-0103"
],
"tags_summary_labels_fr": [
"pat-0088",
"pat-0103"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"port": 8866,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi php wrapper \u00b7 via HTTP:8866 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET http:\/\/146.56.180.42:3333\/ HTTP\/1.1\r\nHost: 146.56.180.42:3333\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "8866 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8866"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_absolute_uri"
]
}
|