|
|
TCP |
8787 · HTTP
|
http
|
Sonde HTTP
http · via HTTP:8787 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
GET / UA Go-http-client/1.1
Émulateur
HTTP
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8787
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 61%
Confiance classification
61%
Risque capteur
Faible
· 35
Confiance : Confiance 61 % — Score WAF 20 · 1 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
Ligne de requête
GET / HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8787
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Meta JSON brut
{"http_header_count":3,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"c3e68bb8f388240c7ecaebb8bcb80a85536526f2","http_host_hash":"7b30b3ebb9e2c6a69cd3436ab6c69c21528a74e6","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":96,"payload_entropy":4.9471234442917975,"port_category":"registered","org":"Storm Industries LLC","service":"http","app_proto":"http","asn":219502,"country":"NL","dst_port":8787,"risk_waf":20,"risk_classification":16,"risk_behavior":0,"risk_geo":0,"risk_protocol":35,"risk_novelty":15,"risk_boost":0,"risk_granularity":2.9,"risk_breakdown":{"waf":20,"classification":16,"behavior":0,"geo":0,"protocol":35,"novelty":15},"risk_score":35,"tag_count":2,"anomaly_count":0,"campaign_key":"09e25b88b0deeff7a25f3d0e98e62d604a3d7782","event_fingerprint":"697398584de469b830458e07d0c36cf23aafb4e4","city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":219502,"org":"Storm Industries LLC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"http_ua_hash":"12bd583dd25b868e6423d8f04cc19fd1","payload_hash":"d92eb1c60b941128aaf8e885dadb0a0b","path_pattern_hash":"8a5edab282632443219e051e4ade2d1d"},"service_name":"http","target_context":{"dst_port":8787,"service":"http","service_name":"http","risk_score":35},"payload_preview":"GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8787\r\nUser-Agent: Go-http-client\/1.1\r…
|
|
|
TCP |
32400 · PLEX
|
plex
|
Sonde Plex
plex · via PLEX:32400 · (sonde / probe)
|
Moyenne
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
Émulateur
PLEX
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
32400
Chemin / cible
—
Service
PLEX
Payload
GET /identity HTTP/1.1 Host: 62.3.50.33:32400 User-Agent: Go-http-client/1.1
Pourquoi cette classification : Type « Sonde Plex » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 1 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /identity HTTP/1.1
Host: 62.3.50.33:32400
User-Agent: Go-http-client/1.1
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f7420706c657820726561647920706f72743d33323430300d0a","emulator_response_len":36,"bytes_in":82,"payload_entropy":4.86309666993535,"port_category":"registered","org":"Storm Industries LLC","service":"plex","app_proto":"plex","asn":219502,"country":"NL","dst_port":32400,"risk_waf":8,"risk_classification":16,"risk_behavior":0,"risk_geo":0,"risk_protocol":32,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.1,"risk_breakdown":{"waf":8,"classification":16,"behavior":0,"geo":0,"protocol":32,"novelty":15},"risk_score":24,"tag_count":1,"anomaly_count":0,"campaign_key":"6c14dfdaebdda58b1cce49b64f27d228607706a3","event_fingerprint":"777f8a95358de68b90dd7f58ad144d387ad4f65e","classification_reason":"Type \u00ab plex \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":16,"behavior":0,"geo":0,"protocol":32,"novelty":15,"risk_score":24},"named_classification_skipped":false,"service_name":"plex","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":219502,"org":"Storm Industries LLC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"cb6f9bcf08984359255d9c5be7df054e","path_pattern_hash":"cf6dd0b6bcff0572500cdd0870089185"},"target_context":{"dst_port":32400,"service":"plex","service_name":"plex…
|
|
|
TCP |
32400 · PLEX
|
plex
|
Sonde Plex
plex · via PLEX:32400 · (sonde / probe)
|
Moyenne
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
Émulateur
PLEX
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
32400
Chemin / cible
—
Service
PLEX
Payload
GET /identity HTTP/1.1 Host: 62.3.50.33:32400 User-Agent: Go-http-client/1.1
Pourquoi cette classification : Type « Sonde Plex » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 1 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /identity HTTP/1.1
Host: 62.3.50.33:32400
User-Agent: Go-http-client/1.1
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f7420706c657820726561647920706f72743d33323430300d0a","emulator_response_len":36,"bytes_in":82,"payload_entropy":4.86309666993535,"port_category":"registered","org":"Storm Industries LLC","service":"plex","app_proto":"plex","asn":219502,"country":"NL","dst_port":32400,"risk_waf":8,"risk_classification":16,"risk_behavior":0,"risk_geo":0,"risk_protocol":32,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.1,"risk_breakdown":{"waf":8,"classification":16,"behavior":0,"geo":0,"protocol":32,"novelty":15},"risk_score":24,"tag_count":1,"anomaly_count":0,"campaign_key":"6c14dfdaebdda58b1cce49b64f27d228607706a3","event_fingerprint":"777f8a95358de68b90dd7f58ad144d387ad4f65e","classification_reason":"Type \u00ab plex \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":16,"behavior":0,"geo":0,"protocol":32,"novelty":15,"risk_score":24},"named_classification_skipped":false,"service_name":"plex","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":219502,"org":"Storm Industries LLC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"cb6f9bcf08984359255d9c5be7df054e","path_pattern_hash":"cf6dd0b6bcff0572500cdd0870089185"},"target_context":{"dst_port":32400,"service":"plex","service_name":"plex…
|
|
|
TCP |
32400 · PLEX
|
plex
|
Sonde Plex
plex · via PLEX:32400 · (sonde / probe)
|
Moyenne
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
Émulateur
PLEX
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
32400
Chemin / cible
—
Service
PLEX
Payload
GET /identity HTTP/1.1 Host: 62.3.50.33:32400 User-Agent: Go-http-client/1.1
Pourquoi cette classification : Type « Sonde Plex » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 1 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /identity HTTP/1.1
Host: 62.3.50.33:32400
User-Agent: Go-http-client/1.1
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f7420706c657820726561647920706f72743d33323430300d0a","emulator_response_len":36,"bytes_in":82,"payload_entropy":4.86309666993535,"port_category":"registered","org":"Storm Industries LLC","service":"plex","app_proto":"plex","asn":219502,"country":"NL","dst_port":32400,"risk_waf":8,"risk_classification":16,"risk_behavior":0,"risk_geo":0,"risk_protocol":32,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.1,"risk_breakdown":{"waf":8,"classification":16,"behavior":0,"geo":0,"protocol":32,"novelty":15},"risk_score":24,"tag_count":1,"anomaly_count":0,"campaign_key":"6c14dfdaebdda58b1cce49b64f27d228607706a3","event_fingerprint":"777f8a95358de68b90dd7f58ad144d387ad4f65e","classification_reason":"Type \u00ab plex \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":16,"behavior":0,"geo":0,"protocol":32,"novelty":15,"risk_score":24},"named_classification_skipped":false,"service_name":"plex","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":219502,"org":"Storm Industries LLC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"cb6f9bcf08984359255d9c5be7df054e","path_pattern_hash":"cf6dd0b6bcff0572500cdd0870089185"},"target_context":{"dst_port":32400,"service":"plex","service_name":"plex…
|
|
|
TCP |
32400 · PLEX
|
plex
|
Sonde Plex
plex · via PLEX:32400 · (sonde / probe)
|
Moyenne
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
Émulateur
PLEX
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
32400
Chemin / cible
—
Service
PLEX
Payload
GET /identity HTTP/1.1 Host: 62.3.50.33:32400 User-Agent: Go-http-client/1.1
Pourquoi cette classification : Type « Sonde Plex » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 1 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /identity HTTP/1.1
Host: 62.3.50.33:32400
User-Agent: Go-http-client/1.1
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f7420706c657820726561647920706f72743d33323430300d0a","emulator_response_len":36,"bytes_in":82,"payload_entropy":4.86309666993535,"port_category":"registered","org":"Storm Industries LLC","service":"plex","app_proto":"plex","asn":219502,"country":"NL","dst_port":32400,"risk_waf":8,"risk_classification":16,"risk_behavior":0,"risk_geo":0,"risk_protocol":32,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.1,"risk_breakdown":{"waf":8,"classification":16,"behavior":0,"geo":0,"protocol":32,"novelty":15},"risk_score":24,"tag_count":1,"anomaly_count":0,"campaign_key":"6c14dfdaebdda58b1cce49b64f27d228607706a3","event_fingerprint":"777f8a95358de68b90dd7f58ad144d387ad4f65e","classification_reason":"Type \u00ab plex \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":16,"behavior":0,"geo":0,"protocol":32,"novelty":15,"risk_score":24},"named_classification_skipped":false,"service_name":"plex","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":219502,"org":"Storm Industries LLC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"cb6f9bcf08984359255d9c5be7df054e","path_pattern_hash":"cf6dd0b6bcff0572500cdd0870089185"},"target_context":{"dst_port":32400,"service":"plex","service_name":"plex…
|
|
|
TCP |
32400 · PLEX
|
plex
|
Sonde Plex
plex · via PLEX:32400 · (sonde / probe)
|
Moyenne
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
Émulateur
PLEX
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
32400
Chemin / cible
—
Service
PLEX
Payload
GET /identity HTTP/1.1 Host: 62.3.50.33:32400 User-Agent: Go-http-client/1.1
Pourquoi cette classification : Type « Sonde Plex » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 1 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /identity HTTP/1.1
Host: 62.3.50.33:32400
User-Agent: Go-http-client/1.1
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f7420706c657820726561647920706f72743d33323430300d0a","emulator_response_len":36,"bytes_in":82,"payload_entropy":4.86309666993535,"port_category":"registered","org":"Storm Industries LLC","service":"plex","app_proto":"plex","asn":219502,"country":"NL","dst_port":32400,"risk_waf":8,"risk_classification":16,"risk_behavior":0,"risk_geo":0,"risk_protocol":32,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.1,"risk_breakdown":{"waf":8,"classification":16,"behavior":0,"geo":0,"protocol":32,"novelty":15},"risk_score":24,"tag_count":1,"anomaly_count":0,"campaign_key":"6c14dfdaebdda58b1cce49b64f27d228607706a3","event_fingerprint":"777f8a95358de68b90dd7f58ad144d387ad4f65e","classification_reason":"Type \u00ab plex \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":16,"behavior":0,"geo":0,"protocol":32,"novelty":15,"risk_score":24},"named_classification_skipped":false,"service_name":"plex","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":219502,"org":"Storm Industries LLC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"cb6f9bcf08984359255d9c5be7df054e","path_pattern_hash":"cf6dd0b6bcff0572500cdd0870089185"},"target_context":{"dst_port":32400,"service":"plex","service_name":"plex…
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → /flows
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
GET /flows UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
net_web_probe
Cible HTTP
GET
/flows
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/flows
Pourquoi cette classification : Type « Sonde HTTP » (signaux protocolaires) · confiance 71%
Confiance classification
71%
Risque capteur
Moyen
· 40
Confiance : Confiance 71 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
Ligne de requête
GET /flows HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /flows HTTP/1.1
Host: 62.3.50.33:8080
User-Agent: Go-http-client/1.1
Accept: application/json
Node-Red-Api-Version: v2
Requête brute (extrait)
GET /flows HTTP/1.1 Host: 62.3.50.33:8080 User-Agent: Go-http-client/1.1 Accept: application/json Node-Red-Api-Version: v2 Accept-Encoding: gzip
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b","emulator_response_len":81,"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":null,"http_ua_hash":"c3e68bb8f388240c7ecaebb8bcb80a85536526f2","http_host_hash":"c9908f9a31aefa5902e21ee9fa132cbe056c536d","http_target_hash":"f9742a9f8847b765487717720ae32644a03f61b9","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":153,"payload_entropy":5.07130773418672,"port_category":"registered","org":"Storm Industries LLC","service":"http","app_proto":"http","asn":219502,"country":"NL","dst_port":8080,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":3.9,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":40,"tag_count":2,"anomaly_count":0,"campaign_key":"fa812ad6f7bea00e0ec0efcca2acbab47534ea96","event_fingerprint":"da62655aad61f41d3b58e8cf2852a0152baf8a72","city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":219502,"org":"Storm Industries LLC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"http_ua_hash":"12bd583dd25b868e6423d8f04cc19fd1","payload_hash":"f95398d4926515dd788935a2683bc6ab","path_pattern_hash":"b05b8a893c…
|
|
|
TCP |
1880 · HTTP
|
http
|
Sonde HTTP
http · via HTTP:1880 · (sonde / probe) · → /flows
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
GET /flows UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/flows
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
1880
Chemin / cible
/flows
Pourquoi cette classification : Type « Sonde HTTP » (signaux protocolaires) · confiance 58%
Confiance classification
58%
Risque capteur
Faible
· 35
Confiance : Confiance 58 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
Ligne de requête
GET /flows HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /flows HTTP/1.1
Host: 62.3.50.33:1880
User-Agent: Go-http-client/1.1
Accept: application/json
Node-Red-Api-Version: v2
Requête brute (extrait)
GET /flows HTTP/1.1 Host: 62.3.50.33:1880 User-Agent: Go-http-client/1.1 Accept: application/json Node-Red-Api-Version: v2 Accept-Encoding: gzip
Meta JSON brut
{"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":null,"http_ua_hash":"c3e68bb8f388240c7ecaebb8bcb80a85536526f2","http_host_hash":"9a67995555862d421d709b7f74b0fa13ba1295b1","http_target_hash":"f9742a9f8847b765487717720ae32644a03f61b9","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":153,"payload_entropy":5.065721113452907,"port_category":"registered","org":"Storm Industries LLC","service":"http","app_proto":"http","asn":219502,"country":"NL","dst_port":1880,"risk_waf":8,"risk_classification":16,"risk_behavior":0,"risk_geo":0,"risk_protocol":35,"risk_novelty":15,"risk_boost":0,"risk_granularity":3.6,"risk_breakdown":{"waf":8,"classification":16,"behavior":0,"geo":0,"protocol":35,"novelty":15},"risk_score":35,"tag_count":1,"anomaly_count":0,"campaign_key":"268980d6e66c457879380afcdc325aad61aa64e5","event_fingerprint":"958f42043d315faf3ebab7c92e8bbb1cce17b6df","city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":219502,"org":"Storm Industries LLC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"http_ua_hash":"12bd583dd25b868e6423d8f04cc19fd1","payload_hash":"c59f0d497bbe55dd43e468991bd634b5","path_pattern_hash":"b05b8a893cff08220277222d20ed475a"},"service_name":"http","target_context":{"dst_port":1880,"service":"http","service_name":"http","risk_score":35},"payload_preview":"GET \/flows HTTP\/1.1\r\nHost: 62.3.50.33:1880\r\nUser-Agent: Go-http-client\/1.…
|
|
|
TCP |
4096 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:4096 · (tentative d'exploit) · → /session
|
Moyenne
|
Moyen · 52
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
Accès
Exécution
Protocole
POST /session UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Investiguer
Tags
http_ua_suspicious
Cible HTTP
POST
/session
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
4096
Chemin / cible
/session
Pourquoi cette classification : Type « Sonde HTTP smuggling » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
Accès initial
Exécution
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /session HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
POST /session HTTP/1.1
Host: 62.3.50.33:4096
User-Agent: Go-http-client/1.1
Content-Length: 2
Content-Type: application/json
Requête brute (extrait)
POST /session HTTP/1.1 Host: 62.3.50.33:4096 User-Agent: Go-http-client/1.1 Content-Length: 2 Content-Type: application/json Accept-Encoding: gzip {}
Meta JSON brut
{"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":null,"http_ua_hash":"c3e68bb8f388240c7ecaebb8bcb80a85536526f2","http_host_hash":"cd8e58382e685ca7a3a17542ee3cfdb3589f7f48","http_target_hash":"9de79fa651998217334995275d96012781124c19","http_referer_hash":null,"http_method":"POST","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":157,"payload_entropy":5.033181756113475,"port_category":"registered","org":"Storm Industries LLC","service":"http","app_proto":"http","asn":219502,"country":"NL","dst_port":4096,"risk_waf":8,"risk_classification":85,"risk_behavior":0,"risk_geo":0,"risk_protocol":35,"risk_novelty":15,"risk_boost":0,"risk_granularity":1,"risk_breakdown":{"waf":8,"classification":85,"behavior":0,"geo":0,"protocol":35,"novelty":15},"risk_score":52,"tag_count":1,"anomaly_count":0,"campaign_key":"0b0198688c139526940c576e808db8f0f733b7b9","event_fingerprint":"8704fcbfaf27fe02585bb7efd2fa4dcfa1be657f","classification_reason":"Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%","confidence":0.95,"classification_confidence":0.95,"precision_score":84,"precision_signals":["pat-0842"],"kb_rule_ids":["pat-0842"],"matched_patterns":["pat-0842"],"matched_pattern_names":["CRS 921130 duplicate CL"],"pattern_ids":["pat-0842"],"confidence_breakdown":{"waf":8,"classification":85,"behavior":0,"geo":0,"protocol":35,"novelty":15,"risk_score":52},"named_classification_skipped":false,"service_name":"http","risk_confiden…
|
|
|
TCP |
3001 · HTTP
|
http
|
Énumération API REST
rest api enum · via HTTP:3001 · (sonde / probe) · → /api/v1/user
|
Élevée
|
Moyen · 59
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
GET /api/v1/user UA Mozilla/5.0 (X11; Linux x86_64) gtmass
Émulateur
HTTP
WAF
25
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950468:nosqli-3
950600:k8s-api
Cible HTTP
GET
/api/v1/user
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3001
Chemin / cible
/api/v1/user
Pourquoi cette classification : Énumération API REST (tag lfi-14) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 59
Confiance : Confiance 95 % — 4 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190-api
Upstream
Api Probe Generic
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
Motifs de détection (base)
Cred Basic auth spray
Probe /api/v1/
Ligne de requête
GET /api/v1/user HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) gtmass
Règles WAF
lfi-14
rce-0
nosqli-3
k8s-api
Payload (extrait)
GET /api/v1/user HTTP/1.1
Host: 62.3.50.33:3001
User-Agent: Mozilla/5.0 (X11; Linux x86_64) gtmass
Authorization: Basic dTc4N
Requête brute (extrait)
GET /api/v1/user HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 (X11; Linux x86_64) gtmass Authorization: Basic dTc4NGViNTc2OnVhRThFUXBHNGhZeDl5 Accept-Encoding: gzip
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d","emulator_response_len":107,"http_header_count":4,"http_query_params":0,"http_path_depth":3,"http_path_ext":null,"http_ua_hash":"ee365f9f4e50def7c01b99724bc7e713375f904f","http_host_hash":"68964bd149320edbceb0d6a222e6bc3e0bdb74e3","http_target_hash":"07de2d286fa948dc9f73305a79bb221364bf573b","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":182,"payload_entropy":5.504372232379877,"port_category":"registered","org":"Storm Industries LLC","service":"http","app_proto":"http","asn":219502,"country":"NL","dst_port":3001,"risk_waf":100,"risk_classification":60,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":0,"risk_granularity":7,"risk_breakdown":{"waf":100,"classification":60,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":59,"tag_count":11,"anomaly_count":0,"campaign_key":"9b24103fca23dc52989e4f75b0df710c64a7e247","event_fingerprint":"d1fd489f5c65aa99554b05a011fcbe5a8b185df7","classification_reason":"\u00c9num\u00e9ration API REST (tag lfi-14) \u00b7 confiance 95%","confidence":0.95,"classification_confidence":0.95,"precision_score":107,"precision_signals":["MITRE-T1190-api","INT-upstream","INT-api-probe-generic"],"kb_rul…
|
|
|
TCP |
3001 · HTTP
|
http
|
probe drupal
probe drupal · via HTTP:3001 · (sonde / probe) · → /user/sign_up
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
GET /user/sign_up UA Mozilla/5.0 (X11; Linux x86_64) gtmass
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950468:nosqli-3
http_probe_drupal
net_web_probe
Cible HTTP
GET
/user/sign_up
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3001
Chemin / cible
/user/sign_up
Pourquoi cette classification : Type « probe_drupal » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
Upstream
Waf Score
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
Ligne de requête
GET /user/sign_up HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) gtmass
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /user/sign_up HTTP/1.1
Host: 62.3.50.33:3001
User-Agent: Mozilla/5.0 (X11; Linux x86_64) gtmass
Accept-Encoding: gzip
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d","emulator_response_len":107,"http_header_count":3,"http_query_params":0,"http_path_depth":2,"http_path_ext":null,"http_ua_hash":"ee365f9f4e50def7c01b99724bc7e713375f904f","http_host_hash":"68964bd149320edbceb0d6a222e6bc3e0bdb74e3","http_target_hash":"107ebe644646bc75f71214ff0c8cf057cf39f524","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":128,"payload_entropy":5.251281966005108,"port_category":"registered","org":"Storm Industries LLC","service":"http","app_proto":"http","asn":219502,"country":"NL","dst_port":3001,"risk_waf":60,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":5.4,"risk_breakdown":{"waf":60,"classification":50,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":45,"tag_count":4,"anomaly_count":0,"campaign_key":"6116d3f3c46d86b19c65b5c446f02c577ea53d9d","event_fingerprint":"d8e7208e856557b27aea53083a95cff1d2de9c74","classification_reason":"Type \u00ab probe_drupal \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence":0.5,"classification_confidence":0.5,"precision_score":55,"precision_signals":["INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-upstr…
|
|
|
TCP |
3001 · HTTP
|
http
|
Énumération API REST
rest api enum · via HTTP:3001 · (sonde / probe) · → /api/v1/version
|
Élevée
|
Moyen · 59
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
GET /api/v1/version UA Mozilla/5.0 (X11; Linux x86_64) gtmass
Émulateur
HTTP
WAF
25
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950468:nosqli-3
950600:k8s-api
Cible HTTP
GET
/api/v1/version
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3001
Chemin / cible
/api/v1/version
Pourquoi cette classification : Énumération API REST (tag lfi-14) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 59
Confiance : Confiance 95 % — 4 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190-api
Upstream
Api Probe Generic
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
Motifs de détection (base)
Probe /api/v1/
Ligne de requête
GET /api/v1/version HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) gtmass
Règles WAF
lfi-14
rce-0
nosqli-3
k8s-api
Payload (extrait)
GET /api/v1/version HTTP/1.1
Host: 62.3.50.33:3001
User-Agent: Mozilla/5.0 (X11; Linux x86_64) gtmass
Accept-Encoding: gzip
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d","emulator_response_len":107,"http_header_count":3,"http_query_params":0,"http_path_depth":3,"http_path_ext":null,"http_ua_hash":"ee365f9f4e50def7c01b99724bc7e713375f904f","http_host_hash":"68964bd149320edbceb0d6a222e6bc3e0bdb74e3","http_target_hash":"c2de2abb2a7854f9621c493468fe183c66cc4cbc","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":130,"payload_entropy":5.260974310112509,"port_category":"registered","org":"Storm Industries LLC","service":"http","app_proto":"http","asn":219502,"country":"NL","dst_port":3001,"risk_waf":100,"risk_classification":60,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":0,"risk_granularity":6.8,"risk_breakdown":{"waf":100,"classification":60,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":59,"tag_count":8,"anomaly_count":0,"campaign_key":"55803912d86a97386c3aff3200e8135c3f5766b4","event_fingerprint":"0b3923a302de7e0ddbb6593f159b015778fc6be1","classification_reason":"\u00c9num\u00e9ration API REST (tag lfi-14) \u00b7 confiance 95%","confidence":0.95,"classification_confidence":0.95,"precision_score":107,"precision_signals":["MITRE-T1190-api","INT-upstream","INT-api-probe-generic"],"kb_ru…
|
|
|
TCP |
3000 · HTTP
|
http
|
Énumération API REST
rest api enum · via HTTP:3000 · (sonde / probe) · → /api/v1/version
|
Élevée
|
Moyen · 59
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
GET /api/v1/version UA Mozilla/5.0 (X11; Linux x86_64) gtmass
Émulateur
HTTP
WAF
25
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950468:nosqli-3
950600:k8s-api
Cible HTTP
GET
/api/v1/version
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3000
Chemin / cible
/api/v1/version
Pourquoi cette classification : Énumération API REST (tag lfi-14) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 59
Confiance : Confiance 95 % — 4 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190-api
Upstream
Api Probe Generic
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
Motifs de détection (base)
Probe /api/v1/
Ligne de requête
GET /api/v1/version HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) gtmass
Règles WAF
lfi-14
rce-0
nosqli-3
k8s-api
Payload (extrait)
GET /api/v1/version HTTP/1.1
Host: 62.3.50.33:3000
User-Agent: Mozilla/5.0 (X11; Linux x86_64) gtmass
Accept-Encoding: gzip
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f","emulator_response_len":106,"http_header_count":3,"http_query_params":0,"http_path_depth":3,"http_path_ext":null,"http_ua_hash":"ee365f9f4e50def7c01b99724bc7e713375f904f","http_host_hash":"46f5955a67387b75de712e640b0687c888a438e5","http_target_hash":"c2de2abb2a7854f9621c493468fe183c66cc4cbc","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":130,"payload_entropy":5.263208879769842,"port_category":"registered","org":"Storm Industries LLC","service":"http","app_proto":"http","asn":219502,"country":"NL","dst_port":3000,"risk_waf":100,"risk_classification":60,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":0,"risk_granularity":6.6,"risk_breakdown":{"waf":100,"classification":60,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":59,"tag_count":8,"anomaly_count":0,"campaign_key":"cb9e7d51fdfe0a48bc02d78c1cc616621917cf00","event_fingerprint":"af1a643347e6422956d1d3163b20fa090cdc333c","classification_reason":"\u00c9num\u00e9ration API REST (tag lfi-14) \u00b7 confiance 95%","confidence":0.95,"classification_confidence":0.95,"precision_score":107,"precision_signals":["MITRE-T1190-api","INT-upstream","INT-api-probe-generic"],"kb_rule…
|
|
|
TCP |
32400 · PLEX
|
plex
|
Sonde Plex
plex · via PLEX:32400 · (sonde / probe)
|
Moyenne
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
Émulateur
PLEX
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
32400
Chemin / cible
—
Service
PLEX
Payload
GET /identity HTTP/1.1 Host: 62.3.50.33:32400 User-Agent: Go-http-client/1.1
Pourquoi cette classification : Type « Sonde Plex » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 1 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /identity HTTP/1.1
Host: 62.3.50.33:32400
User-Agent: Go-http-client/1.1
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f7420706c657820726561647920706f72743d33323430300d0a","emulator_response_len":36,"bytes_in":82,"payload_entropy":4.86309666993535,"port_category":"registered","org":"Storm Industries LLC","service":"plex","app_proto":"plex","asn":219502,"country":"NL","dst_port":32400,"risk_waf":8,"risk_classification":16,"risk_behavior":0,"risk_geo":0,"risk_protocol":32,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.1,"risk_breakdown":{"waf":8,"classification":16,"behavior":0,"geo":0,"protocol":32,"novelty":15},"risk_score":24,"tag_count":1,"anomaly_count":0,"campaign_key":"6c14dfdaebdda58b1cce49b64f27d228607706a3","event_fingerprint":"777f8a95358de68b90dd7f58ad144d387ad4f65e","classification_reason":"Type \u00ab plex \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":16,"behavior":0,"geo":0,"protocol":32,"novelty":15,"risk_score":24},"named_classification_skipped":false,"service_name":"plex","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":219502,"org":"Storm Industries LLC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"cb6f9bcf08984359255d9c5be7df054e","path_pattern_hash":"cf6dd0b6bcff0572500cdd0870089185"},"target_context":{"dst_port":32400,"service":"plex","service_name":"plex…
|
|
|
TCP |
9099 · FLINK
|
flink
|
Sonde Flink
flink probe · via FLINK:9099 · (sonde / probe)
|
Élevée
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
Émulateur
FLINK
WAF
—
Recommandation
Surveiller
Tags
flink_emulated
flink_payload
http_get_probe
net_flink_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9099
Chemin / cible
—
Service
FLINK
Payload
GET /v1 HTTP/1.1 Host: 62.3.50.33:9099 User-Agent: Go-http-client/1.1
Pourquoi cette classification : Type « Sonde Flink » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 4 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /v1 HTTP/1.1
Host: 62.3.50.33:9099
User-Agent: Go-http-client/1.1
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f7420666c696e6b20726561647920706f72743d393039390d0a","emulator_response_len":36,"bytes_in":75,"payload_entropy":4.840643571316486,"port_category":"registered","org":"Storm Industries LLC","service":"flink","app_proto":"flink","asn":219502,"country":"NL","dst_port":9099,"risk_waf":8,"risk_classification":32,"risk_behavior":0,"risk_geo":0,"risk_protocol":40,"risk_novelty":15,"risk_boost":0,"risk_granularity":4,"risk_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":0,"protocol":40,"novelty":15},"risk_score":24,"tag_count":4,"anomaly_count":0,"campaign_key":"14f3788f5559c062133a8d9ad077162358a10d2f","event_fingerprint":"87faa6741f9d84628e3f125521a0f4b29443206e","classification_reason":"Type \u00ab flink_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":0,"protocol":40,"novelty":15,"risk_score":24},"named_classification_skipped":false,"service_name":"flink","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":219502,"org":"Storm Industries LLC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"edb8ed46541f72cdb5a05d6f09472198","path_pattern_hash":"f080be4a0d7a54e1759be39d00dd0925"},"target_context":{"dst_port":9099,"service":"flink","service_nam…
|
|
|
TCP |
9099 · FLINK
|
flink
|
Sonde Flink
flink probe · via FLINK:9099 · (sonde / probe)
|
Élevée
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
Émulateur
FLINK
WAF
—
Recommandation
Surveiller
Tags
flink_emulated
flink_payload
http_get_probe
net_flink_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9099
Chemin / cible
—
Service
FLINK
Payload
GET /v1 HTTP/1.1 Host: 62.3.50.33:9099 User-Agent: Go-http-client/1.1
Pourquoi cette classification : Type « Sonde Flink » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 4 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /v1 HTTP/1.1
Host: 62.3.50.33:9099
User-Agent: Go-http-client/1.1
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f7420666c696e6b20726561647920706f72743d393039390d0a","emulator_response_len":36,"bytes_in":75,"payload_entropy":4.840643571316486,"port_category":"registered","org":"Storm Industries LLC","service":"flink","app_proto":"flink","asn":219502,"country":"NL","dst_port":9099,"risk_waf":8,"risk_classification":32,"risk_behavior":0,"risk_geo":0,"risk_protocol":40,"risk_novelty":15,"risk_boost":0,"risk_granularity":4,"risk_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":0,"protocol":40,"novelty":15},"risk_score":24,"tag_count":4,"anomaly_count":0,"campaign_key":"14f3788f5559c062133a8d9ad077162358a10d2f","event_fingerprint":"87faa6741f9d84628e3f125521a0f4b29443206e","classification_reason":"Type \u00ab flink_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":0,"protocol":40,"novelty":15,"risk_score":24},"named_classification_skipped":false,"service_name":"flink","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":219502,"org":"Storm Industries LLC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"edb8ed46541f72cdb5a05d6f09472198","path_pattern_hash":"f080be4a0d7a54e1759be39d00dd0925"},"target_context":{"dst_port":9099,"service":"flink","service_nam…
|
|
|
TCP |
9099 · FLINK
|
flink
|
Sonde Flink
flink probe · via FLINK:9099 · (sonde / probe)
|
Élevée
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
Émulateur
FLINK
WAF
—
Recommandation
Surveiller
Tags
flink_emulated
flink_payload
http_get_probe
net_flink_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9099
Chemin / cible
—
Service
FLINK
Payload
GET /v1 HTTP/1.1 Host: 62.3.50.33:9099 User-Agent: Go-http-client/1.1
Pourquoi cette classification : Type « Sonde Flink » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 4 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /v1 HTTP/1.1
Host: 62.3.50.33:9099
User-Agent: Go-http-client/1.1
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f7420666c696e6b20726561647920706f72743d393039390d0a","emulator_response_len":36,"bytes_in":75,"payload_entropy":4.840643571316486,"port_category":"registered","org":"Storm Industries LLC","service":"flink","app_proto":"flink","asn":219502,"country":"NL","dst_port":9099,"risk_waf":8,"risk_classification":32,"risk_behavior":0,"risk_geo":0,"risk_protocol":40,"risk_novelty":15,"risk_boost":0,"risk_granularity":4,"risk_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":0,"protocol":40,"novelty":15},"risk_score":24,"tag_count":4,"anomaly_count":0,"campaign_key":"14f3788f5559c062133a8d9ad077162358a10d2f","event_fingerprint":"87faa6741f9d84628e3f125521a0f4b29443206e","classification_reason":"Type \u00ab flink_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":0,"protocol":40,"novelty":15,"risk_score":24},"named_classification_skipped":false,"service_name":"flink","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":219502,"org":"Storm Industries LLC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"edb8ed46541f72cdb5a05d6f09472198","path_pattern_hash":"f080be4a0d7a54e1759be39d00dd0925"},"target_context":{"dst_port":9099,"service":"flink","service_nam…
|
|
|
TCP |
9099 · FLINK
|
flink
|
Sonde Flink
flink probe · via FLINK:9099 · (sonde / probe)
|
Élevée
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
Émulateur
FLINK
WAF
—
Recommandation
Surveiller
Tags
flink_emulated
flink_payload
http_get_probe
net_flink_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9099
Chemin / cible
—
Service
FLINK
Payload
GET /v1 HTTP/1.1 Host: 62.3.50.33:9099 User-Agent: Go-http-client/1.1
Pourquoi cette classification : Type « Sonde Flink » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 4 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /v1 HTTP/1.1
Host: 62.3.50.33:9099
User-Agent: Go-http-client/1.1
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f7420666c696e6b20726561647920706f72743d393039390d0a","emulator_response_len":36,"bytes_in":75,"payload_entropy":4.840643571316486,"port_category":"registered","org":"Storm Industries LLC","service":"flink","app_proto":"flink","asn":219502,"country":"NL","dst_port":9099,"risk_waf":8,"risk_classification":32,"risk_behavior":0,"risk_geo":0,"risk_protocol":40,"risk_novelty":15,"risk_boost":0,"risk_granularity":4,"risk_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":0,"protocol":40,"novelty":15},"risk_score":24,"tag_count":4,"anomaly_count":0,"campaign_key":"14f3788f5559c062133a8d9ad077162358a10d2f","event_fingerprint":"87faa6741f9d84628e3f125521a0f4b29443206e","classification_reason":"Type \u00ab flink_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":0,"protocol":40,"novelty":15,"risk_score":24},"named_classification_skipped":false,"service_name":"flink","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":219502,"org":"Storm Industries LLC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"edb8ed46541f72cdb5a05d6f09472198","path_pattern_hash":"f080be4a0d7a54e1759be39d00dd0925"},"target_context":{"dst_port":9099,"service":"flink","service_nam…
|
|
|
TCP |
32400 · PLEX
|
plex
|
Sonde Plex
plex · via PLEX:32400 · (sonde / probe)
|
Moyenne
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
Émulateur
PLEX
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
32400
Chemin / cible
—
Service
PLEX
Payload
GET /identity HTTP/1.1 Host: 62.3.50.33:32400 User-Agent: Go-http-client/1.1
Pourquoi cette classification : Type « Sonde Plex » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 1 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /identity HTTP/1.1
Host: 62.3.50.33:32400
User-Agent: Go-http-client/1.1
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f7420706c657820726561647920706f72743d33323430300d0a","emulator_response_len":36,"bytes_in":82,"payload_entropy":4.86309666993535,"port_category":"registered","org":"Storm Industries LLC","service":"plex","app_proto":"plex","asn":219502,"country":"NL","dst_port":32400,"risk_waf":8,"risk_classification":16,"risk_behavior":0,"risk_geo":0,"risk_protocol":32,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.1,"risk_breakdown":{"waf":8,"classification":16,"behavior":0,"geo":0,"protocol":32,"novelty":15},"risk_score":24,"tag_count":1,"anomaly_count":0,"campaign_key":"6c14dfdaebdda58b1cce49b64f27d228607706a3","event_fingerprint":"777f8a95358de68b90dd7f58ad144d387ad4f65e","classification_reason":"Type \u00ab plex \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":16,"behavior":0,"geo":0,"protocol":32,"novelty":15,"risk_score":24},"named_classification_skipped":false,"service_name":"plex","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":219502,"org":"Storm Industries LLC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"cb6f9bcf08984359255d9c5be7df054e","path_pattern_hash":"cf6dd0b6bcff0572500cdd0870089185"},"target_context":{"dst_port":32400,"service":"plex","service_name":"plex…
|
|
|
TCP |
32400 · PLEX
|
plex
|
Sonde Plex
plex · via PLEX:32400 · (sonde / probe)
|
Moyenne
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
Émulateur
PLEX
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
32400
Chemin / cible
—
Service
PLEX
Payload
GET /identity HTTP/1.1 Host: 62.3.50.33:32400 User-Agent: Go-http-client/1.1
Pourquoi cette classification : Type « Sonde Plex » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 1 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /identity HTTP/1.1
Host: 62.3.50.33:32400
User-Agent: Go-http-client/1.1
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f7420706c657820726561647920706f72743d33323430300d0a","emulator_response_len":36,"bytes_in":82,"payload_entropy":4.86309666993535,"port_category":"registered","org":"Storm Industries LLC","service":"plex","app_proto":"plex","asn":219502,"country":"NL","dst_port":32400,"risk_waf":8,"risk_classification":16,"risk_behavior":0,"risk_geo":0,"risk_protocol":32,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.1,"risk_breakdown":{"waf":8,"classification":16,"behavior":0,"geo":0,"protocol":32,"novelty":15},"risk_score":24,"tag_count":1,"anomaly_count":0,"campaign_key":"6c14dfdaebdda58b1cce49b64f27d228607706a3","event_fingerprint":"777f8a95358de68b90dd7f58ad144d387ad4f65e","classification_reason":"Type \u00ab plex \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":16,"behavior":0,"geo":0,"protocol":32,"novelty":15,"risk_score":24},"named_classification_skipped":false,"service_name":"plex","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":219502,"org":"Storm Industries LLC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"cb6f9bcf08984359255d9c5be7df054e","path_pattern_hash":"cf6dd0b6bcff0572500cdd0870089185"},"target_context":{"dst_port":32400,"service":"plex","service_name":"plex…
|