Détails IP 1.226.4.189

Synthèse exécutive

Profil de menace

Score de risque 54/100 Moyen

Première observation 27/07/2026 03:01 UTC

Dernière observation 27/07/2026 03:03 UTC

Événements (période) 4,456

MITRE ATT&CK principal TA0007 4455 occurrences

Activité suspecte · risque 32/100

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Rafale d'authentification SSH · confiance 49%

Confiance 49 % — Score WAF 8

Comparaison ASN / FAI

ASN 9318 · 1.224.0.0/11 · APNIC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 4,456 événements sur la période pour cette IP.

211.186.115.35 Sonde port 26/07/2026 14:42 UTC
121.125.67.137 Sonde SSH 26/07/2026 04:14 UTC
58.229.253.119 Sonde SSH 25/07/2026 02:52 UTC
222.232.176.7 Sonde SSH 24/07/2026 12:29 UTC
211.178.247.182 Sonde SSH 23/07/2026 07:15 UTC
118.216.88.229 Sonde port 23/TCP 21/07/2026 18:56 UTC
219.250.188.143 Sonde SSH 19/07/2026 20:17 UTC
58.224.62.29 Sonde SSH 17/07/2026 01:34 UTC

IPs apparentées

Même FAI SK Broadband Co Ltd — corrélation indicative.

211.186.115.35 Sonde port
121.125.67.137 Sonde SSH
58.229.253.119 Sonde SSH
222.232.176.7 Sonde SSH
211.178.247.182 Sonde SSH

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Chronologie des événements

4456 événement(s) — page 1/90

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R��$yJ��@��ݮ�Ld��1� �wH��9�7� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R��$yJ��@��ݮ�Ld��1� �wH��9�7� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.6328331300295424, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "dbe62627df728d2d340d7a1ea85ebabc", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffd\u001a$yJ\ufffd\ufffd@\ufffd\ufffd\ufffd\u076e\ufffdLd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffd\u001a$yJ\ufffd\ufffd@\ufffd\ufffd\ufffd\u076e\ufffdLd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffd\u001a$yJ\ufffd\ufffd@\ufffd\ufffd\ufffd\u076e\ufffdLd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffd\u001a$yJ\ufffd\ufffd@\ufffd\ufffd\ufffd\u076e\ufffdLd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffd\u001a$yJ\ufffd\ufffd@\ufffd\ufffd\ufffd\u076e\ufffdLd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f49c27249f89ab6f83ee1b4d355c48f7451c7fbf", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffd\u001a$yJ\ufffd\ufffd@\ufffd\ufffd\ufffd\u076e\ufffdLd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd$yJ\ufffd\ufffd@\ufffd\ufffd\ufffd\u076e\ufffdLd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffd\u001a$yJ\ufffd\ufffd@\ufffd\ufffd\ufffd\u076e\ufffdLd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd$yJ\ufffd\ufffd@\ufffd\ufffd\ufffd\u076e\ufffdLd\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R&T��J��oNI�L,��@!Pm�h�D�E�LK$�˲ Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R&T��J��oNI�L,��@!Pm�h�D�E�LK$�˲ Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.560972624687378, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b4e09f54502047edf82389f37c043887", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd\ufffdJ\ufffd\ufffdoNI\ufffdL,\ufffd\ufffd@!Pm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02f2\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd\ufffdJ\ufffd\ufffdoNI\ufffdL,\ufffd\ufffd@!Pm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02f2\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd\ufffdJ\ufffd\ufffdoNI\ufffdL,\ufffd\ufffd@!Pm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02f2\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd\ufffdJ\ufffd\ufffdoNI\ufffdL,\ufffd\ufffd@!Pm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02f2\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd\ufffdJ\ufffd\ufffdoNI\ufffdL,\ufffd\ufffd@!Pm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02f2\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bed41e1845202c8b04584a85beddf7aed9984aba", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd\ufffdJ\ufffd\ufffdoNI\ufffdL,\ufffd\ufffd@!Pm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02f2\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR&T\ufffd\ufffdJ\ufffd\ufffdoNI\ufffdL,\ufffd\ufffd@!Pm\ufffdh\ufffdD\ufffdE\ufffdLK$\ufffd\u02f2", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\ufffd\ufffdJ\ufffd\ufffdoNI\ufffdL,\ufffd\ufffd@!Pm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02f2\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR&T\ufffd\ufffdJ\ufffd\ufffdoNI\ufffdL,\ufffd\ufffd@!Pm\ufffdh\ufffdD\ufffdE\ufffdLK$\ufffd\u02f2", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R4@�1_gkN��kepqC�NS,�K� Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R4@�1_gkN��kepqC�NS,�K� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.505864316904762, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "51a26907cd9cba42d251a1505f860f77", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\u000e@\ufffd1_gkN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\u000e@\ufffd1_gkN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\u000e@\ufffd1_gkN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\u000e@\ufffd1_gkN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\u000e@\ufffd1_gkN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f48f62ea174a1a413c2d58c5a9768d33b1a3d46b", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\u000e@\ufffd1_gkN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR4@\ufffd1_gkN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdkepqC\ufffdNS,\ufffdK\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\u000e@\ufffd1_gkN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR4@\ufffd1_gkN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdkepqC\ufffdNS,\ufffdK\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R"<9�ѪM>@�F��FDq��x�L��,Pf�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R"<9�ѪM>@�F��FDq��x�L��,Pf�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.640863848137664, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "9ca82e09c83a68faeebda2ba24800157", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u00009\u0015\ufffd\u046aM>@\ufffdF\ufffd\ufffd\b\ufffd\ufffdFDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u00009\u0015\ufffd\u046aM>@\ufffdF\ufffd\ufffd\b\ufffd\ufffdFDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u00009\u0015\ufffd\u046aM>@\ufffdF\ufffd\ufffd\b\ufffd\ufffdFDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u00009\u0015\ufffd\u046aM>@\ufffdF\ufffd\ufffd\b\ufffd\ufffdFDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u00009\u0015\ufffd\u046aM>@\ufffdF\ufffd\ufffd\b\ufffd\ufffdFDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "36824e4360f50e844e74e3b31d18465b66be3335", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u00009\u0015\ufffd\u046aM>@\ufffdF\ufffd\ufffd\b\ufffd\ufffdFDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\"<9\ufffd\u046aM>@\ufffdF\ufffd\ufffd\ufffd\ufffdFDq\ufffd\ufffdx\ufffdL\ufffd\ufffd,Pf\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u00009\u0015\ufffd\u046aM>@\ufffdF\ufffd\ufffd\b\ufffd\ufffdFDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\"<9\ufffd\u046aM>@\ufffdF\ufffd\ufffd\ufffd\ufffdFDq\ufffd\ufffdx\ufffdL\ufffd\ufffd,Pf\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R ��m��K��&� ��B!1I�� O<�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R ��m��K��&��B!1I�� O<�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.619587252392983, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e170400715515ba756fd14f3478a7e90", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffd\ufffdm\u0017\ufffd\ufffdK\ufffd\ufffd\u001c\ufffd&\ufffd\u000b\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffd\ufffdm\u0017\ufffd\ufffdK\ufffd\ufffd\u001c\ufffd&\ufffd\u000b\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffd\ufffdm\u0017\ufffd\ufffdK\ufffd\ufffd\u001c\ufffd&\ufffd\u000b\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffd\ufffdm\u0017\ufffd\ufffdK\ufffd\ufffd\u001c\ufffd&\ufffd\u000b\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffd\ufffdm\u0017\ufffd\ufffdK\ufffd\ufffd\u001c\ufffd&\ufffd\u000b\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5b8986669449796c4995c460d02129fb20d9cefc", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffd\ufffdm\u0017\ufffd\ufffdK\ufffd\ufffd\u001c\ufffd&\ufffd\u000b\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\r\ufffd\ufffd\ufffd\ufffdm\ufffd\ufffdK\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u0000\ufffd\ufffd\ufffdm\u0017\ufffd\ufffdK\ufffd\ufffd\u001c\ufffd&\ufffd\u000b\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\r\ufffd\ufffd\ufffd\ufffdm\ufffd\ufffdK\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R8�[O��B��G�ty:��(�v�LN�&�(�/6� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R8�[O��B��G�ty:��(�v�LN�&�(�/6� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.640863848137664, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "91d1e462a40683ef13c809ca89075de0", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd[O\ufffd\ufffd\u001c\ufffdB\ufffd\ufffdG\ufffdty:\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd[O\ufffd\ufffd\u001c\ufffdB\ufffd\ufffdG\ufffdty:\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd[O\ufffd\ufffd\u001c\ufffdB\ufffd\ufffdG\ufffdty:\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd[O\ufffd\ufffd\u001c\ufffdB\ufffd\ufffdG\ufffdty:\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd[O\ufffd\ufffd\u001c\ufffdB\ufffd\ufffdG\ufffdty:\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bd57b42f46e65cb80d176dddafb9f9ae3ecbba4a", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd[O\ufffd\ufffd\u001c\ufffdB\ufffd\ufffdG\ufffdty:\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR8\ufffd[O\ufffd\ufffd\ufffdB\ufffd\ufffdG\ufffdty:\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/6\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffd[O\ufffd\ufffd\u001c\ufffdB\ufffd\ufffdG\ufffdty:\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR8\ufffd[O\ufffd\ufffd\ufffdB\ufffd\ufffdG\ufffdty:\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/6\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R%��`wO��>}+ l��J��L��ͅ� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R%��`wO��>}+l��J��L��ͅ� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.590279938540182, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8609aa069ff26426a6ced5eecb5d2b88", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000\ufffd\u001c\ufffd\u0012\ufffd`wO\ufffd\ufffd\u0015>}+\u000bl\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000\ufffd\u001c\ufffd\u0012\ufffd`wO\ufffd\ufffd\u0015>}+\u000bl\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000\ufffd\u001c\ufffd\u0012\ufffd`wO\ufffd\ufffd\u0015>}+\u000bl\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000\ufffd\u001c\ufffd\u0012\ufffd`wO\ufffd\ufffd\u0015>}+\u000bl\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000\ufffd\u001c\ufffd\u0012\ufffd`wO\ufffd\ufffd\u0015>}+\u000bl\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "064c364cfbba87070b8271715b14619f3aa80119", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000\ufffd\u001c\ufffd\u0012\ufffd`wO\ufffd\ufffd\u0015>}+\u000bl\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR%\ufffd\ufffd\ufffd\ufffd`wO\ufffd\ufffd>}+l\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\u0345\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000%\ufffd\u0000\ufffd\u001c\ufffd\u0012\ufffd`wO\ufffd\ufffd\u0015>}+\u000bl\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\u0345\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR%\ufffd\ufffd\ufffd\ufffd`wO\ufffd\ufffd>}+l\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\u0345\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R ��Ң��@�2��dd_�D��,N�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R��Ң��@�2��dd_�D��,N�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.619587252392983, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e7d6e2bf3f09f07620f6decf29437d15", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\ufffd\ufffd\u04a2\ufffd\ufffd\ufffd@\ufffd2\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\ufffd\ufffd\u04a2\ufffd\ufffd\ufffd@\ufffd2\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\ufffd\ufffd\u04a2\ufffd\ufffd\ufffd@\ufffd2\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\ufffd\ufffd\u04a2\ufffd\ufffd\ufffd@\ufffd2\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\ufffd\ufffd\u04a2\ufffd\ufffd\ufffd@\ufffd2\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e2f6a3f479636b315697efd38d1367c5fc3b9f63", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\ufffd\ufffd\u04a2\ufffd\ufffd\ufffd@\ufffd2\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\ufffd\u04a2\ufffd\ufffd\ufffd@\ufffd2\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u0000\ufffd\ufffd\u04a2\ufffd\ufffd\ufffd@\ufffd2\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\ufffd\u04a2\ufffd\ufffd\ufffd@\ufffd2\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�RPҡ�,��$N��f�G¾�W��WIK��x��B� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�RPҡ�,��$N��f�G¾�W��WIK��x��B� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.5690033427955, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "9c2580a3749108f07d9c1e3bbe0fba95", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\u04a1\ufffd,\ufffd\ufffd$N\ufffd\ufffdf\ufffdG\u00be\ufffdW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\u04a1\ufffd,\ufffd\ufffd$N\ufffd\ufffdf\ufffdG\u00be\ufffdW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\u04a1\ufffd,\ufffd\ufffd$N\ufffd\ufffdf\ufffdG\u00be\ufffdW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\u04a1\ufffd,\ufffd\ufffd$N\ufffd\ufffdf\ufffdG\u00be\ufffdW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\u04a1\ufffd,\ufffd\ufffd$N\ufffd\ufffdf\ufffdG\u00be\ufffdW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "dbe0d3f2ea71cfc5fb853a65129ce034e179c379", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\u04a1\ufffd,\ufffd\ufffd$N\ufffd\ufffdf\ufffdG\u00be\ufffdW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdRP\u04a1\ufffd,\ufffd\ufffd$N\ufffd\ufffdf\ufffdG\u00be\ufffdW\ufffd\ufffd\ufffdWIK\ufffd\ufffdx\ufffd\ufffdB\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000\u04a1\ufffd,\ufffd\ufffd$N\ufffd\ufffdf\ufffdG\u00be\ufffdW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdRP\u04a1\ufffd,\ufffd\ufffd$N\ufffd\ufffdf\ufffdG\u00be\ufffdW\ufffd\ufffd\ufffdWIK\ufffd\ufffdx\ufffd\ufffdB\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R"�.~5�߱�L��@q��G��X�vni� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R"�.~5�߱�L��@q��G��X�vni� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.619587252392983, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0aba50e73bcb48c19e24720e91bbabc1", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000.~5\ufffd\u07f1\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\u001e\ufffd\u001f\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000.~5\ufffd\u07f1\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\u001e\ufffd\u001f\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000.~5\ufffd\u07f1\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\u001e\ufffd\u001f\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000.~5\ufffd\u07f1\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\u001e\ufffd\u001f\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000.~5\ufffd\u07f1\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\u001e\ufffd\u001f\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "95ff88dce0b9ca4d73d4983445d7deb9b2acc251", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000.~5\ufffd\u07f1\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\u001e\ufffd\u001f\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\"\ufffd.~5\ufffd\u07f1\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"\ufffd\u0000.~5\ufffd\u07f1\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\u001e\ufffd\u001f\ufffd\u001e\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\"\ufffd.~5\ufffd\u07f1\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd@q\ufffd\ufffdG\ufffd\ufffdX\ufffdvni\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R�'ӻ��qrL�?v"��oP�B � �K�;�}7�7� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin NFS RPC mount STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R�'ӻ��qrL�?v"��oP�B ��K�;�}7�7� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.662140443882346, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "NFS RPC mount", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0532", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3f2de9ddbe65959194e5d746d3b7a9cb", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000'\u04fb\ufffd\ufffdqrL\ufffd?v\"\ufffd\u001b\ufffdoP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000'\u04fb\ufffd\ufffdqrL\ufffd?v\"\ufffd\u001b\ufffdoP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000'\u04fb\ufffd\ufffdqrL\ufffd?v\"\ufffd\u001b\ufffdoP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000'\u04fb\ufffd\ufffdqrL\ufffd?v\"\ufffd\u001b\ufffdoP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000'\u04fb\ufffd\ufffdqrL\ufffd?v\"\ufffd\u001b\ufffdoP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9d1e95e6f96af1d4c3538f13047fd36985308342", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000'\u04fb\ufffd\ufffdqrL\ufffd?v\"\ufffd\u001b\ufffdoP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd'\u04fb\ufffd\ufffdqrL\ufffd?v\"\ufffd\ufffdoP\ufffdB\n\ufffd\ufffdK\ufffd;\ufffd}7\ufffd7\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0002\ufffd\u0000'\u04fb\ufffd\ufffdqrL\ufffd?v\"\ufffd\u001b\ufffdoP\ufffdB\n\ufffd\u000b\ufffdK\ufffd;\ufffd}7\ufffd7\u001d\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd'\u04fb\ufffd\ufffdqrL\ufffd?v\"\ufffd\ufffdoP\ufffdB\n\ufffd\ufffdK\ufffd;\ufffd}7\ufffd7\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R'T�e��0D�o��0��2��cþA�F-�4j� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R'T�e��0D�o��0��2��cþA�F-�4j� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.569003342795501, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8623cf30a234655b71d8b543cbe0cf32", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000T\ufffd\u0015e\ufffd\ufffd0D\ufffdo\u000e\ufffd\ufffd0\ufffd\ufffd2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000T\ufffd\u0015e\ufffd\ufffd0D\ufffdo\u000e\ufffd\ufffd0\ufffd\ufffd2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000T\ufffd\u0015e\ufffd\ufffd0D\ufffdo\u000e\ufffd\ufffd0\ufffd\ufffd2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000T\ufffd\u0015e\ufffd\ufffd0D\ufffdo\u000e\ufffd\ufffd0\ufffd\ufffd2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000T\ufffd\u0015e\ufffd\ufffd0D\ufffdo\u000e\ufffd\ufffd0\ufffd\ufffd2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5870eb9031d3f1f60313f57068aaa0ff60d83dda", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000T\ufffd\u0015e\ufffd\ufffd0D\ufffdo\u000e\ufffd\ufffd0\ufffd\ufffd2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR'T\ufffde\ufffd\ufffd0D\ufffdo\ufffd\ufffd0\ufffd\ufffd2\ufffd\ufffdc\u00feA\ufffdF-\ufffd4j\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000'\u0010\u0000T\ufffd\u0015e\ufffd\ufffd0D\ufffdo\u000e\ufffd\ufffd0\ufffd\ufffd2\ufffd\u0019\ufffdc\u00feA\ufffdF-\ufffd4\u001c\u001cj\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR'T\ufffde\ufffd\ufffd0D\ufffdo\ufffd\ufffd0\ufffd\ufffd2\ufffd\ufffdc\u00feA\ufffdF-\ufffd4j\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R�V�!�j�O�}�\|�T��w�M�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R�V�!�j�O�}�\|�T��w�M�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.632833130029542, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "fd48e3c5b42d7f47b19eb0be71edc448", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000V\ufffd\u0014!\ufffdj\ufffdO\ufffd}\ufffd\|\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000V\ufffd\u0014!\ufffdj\ufffdO\ufffd}\ufffd\|\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000V\ufffd\u0014!\ufffdj\ufffdO\ufffd}\ufffd\|\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000V\ufffd\u0014!\ufffdj\ufffdO\ufffd}\ufffd\|\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000V\ufffd\u0014!\ufffdj\ufffdO\ufffd}\ufffd\|\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c45fd8f2a688f4f2157b10c1a69186d46b8df421", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000V\ufffd\u0014!\ufffdj\ufffdO\ufffd}\ufffd\|\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffdV\ufffd!\ufffdj\ufffdO\ufffd}\ufffd\|\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\ufffd\u0000V\ufffd\u0014!\ufffdj\ufffdO\ufffd}\ufffd\|\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd\u0012w\u0016\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\u001f\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffdV\ufffd!\ufffdj\ufffdO\ufffd}\ufffd\|\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R��>��,L��Q84!��XM�F� ؎�� Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R��>��,L��Q84!��XM�F� ؎�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.606341374756425, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c4f9a55e1faf46137d0b973d47457bec", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd>\ufffd\ufffd,L\ufffd\ufffd\ufffd\ufffdQ\b84\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd>\ufffd\ufffd,L\ufffd\ufffd\ufffd\ufffdQ\b84\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd>\ufffd\ufffd,L\ufffd\ufffd\ufffd\ufffdQ\b84\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd>\ufffd\ufffd,L\ufffd\ufffd\ufffd\ufffdQ\b84\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd>\ufffd\ufffd,L\ufffd\ufffd\ufffd\ufffdQ\b84\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "46aec96c24c7e855159ea07401844e8a8cf01764", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd>\ufffd\ufffd,L\ufffd\ufffd\ufffd\ufffdQ\b84\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd>\ufffd\ufffd,L\ufffd\ufffd\ufffd\ufffdQ84!\ufffd\ufffdXM\ufffdF\ufffd\r\u060e\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000\ufffd>\ufffd\ufffd,L\ufffd\ufffd\ufffd\ufffdQ\b84\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd>\ufffd\ufffd,L\ufffd\ufffd\ufffd\ufffdQ84!\ufffd\ufffdXM\ufffdF\ufffd\r\u060e\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�RwJ��9RL�X��,�L歽rvA�U�X�m� Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�RwJ��9RL�X��,�L歽rvA�U�X�m� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.5557574651589405, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "913e6cc9a2607c8bf8ab7eafcbf1a6e0", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000wJ\u001b\ufffd\ufffd9RL\ufffd\u0016X\ufffd\ufffd,\u0007\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000wJ\u001b\ufffd\ufffd9RL\ufffd\u0016X\ufffd\ufffd,\u0007\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000wJ\u001b\ufffd\ufffd9RL\ufffd\u0016X\ufffd\ufffd,\u0007\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000wJ\u001b\ufffd\ufffd9RL\ufffd\u0016X\ufffd\ufffd,\u0007\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000wJ\u001b\ufffd\ufffd9RL\ufffd\u0016X\ufffd\ufffd,\u0007\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a4cf8defa42b997b878c8480e63bb0754cb744de", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000wJ\u001b\ufffd\ufffd9RL\ufffd\u0016X\ufffd\ufffd,\u0007\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdRwJ\ufffd\ufffd9RL\ufffdX\ufffd\ufffd,\ufffdL\u6b7drvA\ufffdU\ufffdX\ufffdm\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000wJ\u001b\ufffd\ufffd9RL\ufffd\u0016X\ufffd\ufffd,\u0007\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdRwJ\ufffd\ufffd9RL\ufffdX\ufffd\ufffd,\ufffdL\u6b7drvA\ufffdU\ufffdX\ufffdm\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R@ͳ�9<�F��] N��y��ԳH�j�ց沲 Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R@ͳ�9<�F��] N��y��ԳH�j�ց沲 Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.619587252392984, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "134f36bb7d7b7a28750ff02b24fcaad9", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000\u0373\u001e\ufffd9<\ufffdF\ufffd\ufffd\ufffd\ufffd]\rN\ufffd\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cb2\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000\u0373\u001e\ufffd9<\ufffdF\ufffd\ufffd\ufffd\ufffd]\rN\ufffd\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cb2\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000\u0373\u001e\ufffd9<\ufffdF\ufffd\ufffd\ufffd\ufffd]\rN\ufffd\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cb2\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000\u0373\u001e\ufffd9<\ufffdF\ufffd\ufffd\ufffd\ufffd]\rN\ufffd\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cb2\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000\u0373\u001e\ufffd9<\ufffdF\ufffd\ufffd\ufffd\ufffd]\rN\ufffd\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cb2\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "99cdc62b306204be940ee22f9c2ceaff3abb5864", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000\u0373\u001e\ufffd9<\ufffdF\ufffd\ufffd\ufffd\ufffd]\rN\ufffd\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cb2\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR@\u0373\ufffd9<\ufffdF\ufffd\ufffd\ufffd\ufffd]\rN\ufffd\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffdj\ufffd\u0581\u6cb2", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000\u0373\u001e\ufffd9<\ufffdF\ufffd\ufffd\ufffd\ufffd]\rN\ufffd\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cb2\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR@\u0373\ufffd9<\ufffdF\ufffd\ufffd\ufffd\ufffd]\rN\ufffd\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffdj\ufffd\u0581\u6cb2", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R�f�x��5G��$%[�o�&R\��7K��#h�._� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R�f�x��5G��$%[�o�&R\��7K��#h�._� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.619587252392984, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1dc3ee87ba0130cf88f25d81a1a4b991", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000f\u000e\ufffdx\ufffd\ufffd5G\ufffd\ufffd$%\u0004[\ufffdo\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000f\u000e\ufffdx\ufffd\ufffd5G\ufffd\ufffd$%\u0004[\ufffdo\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000f\u000e\ufffdx\ufffd\ufffd5G\ufffd\ufffd$%\u0004[\ufffdo\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000f\u000e\ufffdx\ufffd\ufffd5G\ufffd\ufffd$%\u0004[\ufffdo\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000f\u000e\ufffdx\ufffd\ufffd5G\ufffd\ufffd$%\u0004[\ufffdo\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f1692c1f5e839b6cc91f127679533623aa8b0c24", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000f\u000e\ufffdx\ufffd\ufffd5G\ufffd\ufffd$%\u0004[\ufffdo\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffdf\ufffdx\ufffd\ufffd5G\ufffd\ufffd$%[\ufffdo\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\ufffd._\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000f\u000e\ufffdx\ufffd\ufffd5G\ufffd\ufffd$%\u0004[\ufffdo\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffdf\ufffdx\ufffd\ufffd5G\ufffd\ufffd$%[\ufffdo\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\ufffd._\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�Rd��dQgGM��kG4��D~?K�KiSY?�[� Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�Rd��dQgGM��kG4��D~?K�KiSY?�[� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.526450151306139, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "61779e0ed082ac40e83d956fa90abd4a", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000\ufffd\ufffd\ufffddQgGM\ufffd\u001a\ufffd\u0005\ufffd\ufffdk\u0006G4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000\ufffd\ufffd\ufffddQgGM\ufffd\u001a\ufffd\u0005\ufffd\ufffdk\u0006G4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000\ufffd\ufffd\ufffddQgGM\ufffd\u001a\ufffd\u0005\ufffd\ufffdk\u0006G4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000\ufffd\ufffd\ufffddQgGM\ufffd\u001a\ufffd\u0005\ufffd\ufffdk\u0006G4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000\ufffd\ufffd\ufffddQgGM\ufffd\u001a\ufffd\u0005\ufffd\ufffdk\u0006G4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7c0ce89442a8ba32ecba3df0276717c62316fd45", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000\ufffd\ufffd\ufffddQgGM\ufffd\u001a\ufffd\u0005\ufffd\ufffdk\u0006G4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdRd\ufffd\ufffd\ufffddQgGM\ufffd\ufffd\ufffd\ufffdkG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000\ufffd\ufffd\ufffddQgGM\ufffd\u001a\ufffd\u0005\ufffd\ufffdk\u0006G4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdRd\ufffd\ufffd\ufffddQgGM\ufffd\ufffd\ufffd\ufffdkG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�RDҖ��K�d��h��_ek��@��n��z�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�RDҖ��K�d��h��_ek��@��n��z�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.654109725774224, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c794d33fa057bb19b8bd9457dd09efe0", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000D\u0496\ufffd\u0019\ufffd\u001fK\ufffdd\ufffd\ufffdh\ufffd\u0012\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000D\u0496\ufffd\u0019\ufffd\u001fK\ufffdd\ufffd\ufffdh\ufffd\u0012\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000D\u0496\ufffd\u0019\ufffd\u001fK\ufffdd\ufffd\ufffdh\ufffd\u0012\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000D\u0496\ufffd\u0019\ufffd\u001fK\ufffdd\ufffd\ufffdh\ufffd\u0012\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000D\u0496\ufffd\u0019\ufffd\u001fK\ufffdd\ufffd\ufffdh\ufffd\u0012\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c1e97490482709a44229142e6a1e213a54eaf0d5", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000D\u0496\ufffd\u0019\ufffd\u001fK\ufffdd\ufffd\ufffdh\ufffd\u0012\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdRD\u0496\ufffd\ufffdK\ufffdd\ufffd\ufffdh\ufffd\ufffd_ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000D\u0496\ufffd\u0019\ufffd\u001fK\ufffdd\ufffd\ufffdh\ufffd\u0012\ufffd_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdRD\u0496\ufffd\ufffdK\ufffdd\ufffd\ufffdh\ufffd\ufffd_ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R�2"р(M�K�I�{�K�΅h�AH��dt� � Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R�2"р(M�K�I�{�K�΅h�AH��dt� � Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.5983106566483025, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "96221bf55513c1633b38438173e2960e", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u00002\"\u0440(M\ufffdK\ufffd\u0010I\ufffd{\ufffdK\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u00002\"\u0440(M\ufffdK\ufffd\u0010I\ufffd{\ufffdK\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u00002\"\u0440(M\ufffdK\ufffd\u0010I\ufffd{\ufffdK\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u00002\"\u0440(M\ufffdK\ufffd\u0010I\ufffd{\ufffdK\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u00002\"\u0440(M\ufffdK\ufffd\u0010I\ufffd{\ufffdK\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d5647ec10ea69dbf21ef4d2a4095faa271069184", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u00002\"\u0440(M\ufffdK\ufffd\u0010I\ufffd{\ufffdK\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd2\"\u0440(M\ufffdK\ufffdI\ufffd{\ufffdK\ufffd\u0385h\ufffdAH\ufffd\ufffddt\ufffd \ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u00002\"\u0440(M\ufffdK\ufffd\u0010I\ufffd{\ufffdK\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd2\"\u0440(M\ufffdK\ufffdI\ufffd{\ufffdK\ufffd\u0385h\ufffdAH\ufffd\ufffddt\ufffd \ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R\|'r�%�G��\��H�4��eh�B��M�n8� Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R\|'r�%�G��\��H�4��eh�B��M�n8� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.662140443882345, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "005952ac91a32271394c44ae7c70c3ba", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000'r\ufffd%\ufffdG\ufffd\ufffd\\\ufffd\u0007\ufffdH\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000'r\ufffd%\ufffdG\ufffd\ufffd\\\ufffd\u0007\ufffdH\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000'r\ufffd%\ufffdG\ufffd\ufffd\\\ufffd\u0007\ufffdH\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000'r\ufffd%\ufffdG\ufffd\ufffd\\\ufffd\u0007\ufffdH\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000'r\ufffd%\ufffdG\ufffd\ufffd\\\ufffd\u0007\ufffdH\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bc6c935e3dcd92f9c46f187f5c1a3418453f4773", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000'r\ufffd%\ufffdG\ufffd\ufffd\\\ufffd\u0007\ufffdH\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\|'r\ufffd%\ufffdG\ufffd\ufffd\\\ufffd\ufffdH\ufffd4\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u0000'r\ufffd%\ufffdG\ufffd\ufffd\\\ufffd\u0007\ufffdH\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\|'r\ufffd%\ufffdG\ufffd\ufffd\\\ufffd\ufffdH\ufffd4\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R �P�Ӧ�L<I�Հ_�e��.�C��E��2��F�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R �P�Ӧ�L<I�Հ_�e��.�C��E��2��F�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.683417039627026, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0efa819205e59f88897a942eb031c7da", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000P\ufffd\u04e6\ufffdL<I\ufffd\u0540_\ufffd\u0005e\ufffd\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000P\ufffd\u04e6\ufffdL<I\ufffd\u0540_\ufffd\u0005e\ufffd\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000P\ufffd\u04e6\ufffdL<I\ufffd\u0540_\ufffd\u0005e\ufffd\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000P\ufffd\u04e6\ufffdL<I\ufffd\u0540_\ufffd\u0005e\ufffd\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000P\ufffd\u04e6\ufffdL<I\ufffd\u0540_\ufffd\u0005e\ufffd\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bee9a0806f4313461dcc94d0021e85b8ff8d63c1", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000P\ufffd\u04e6\ufffdL<I\ufffd\u0540_\ufffd\u0005e\ufffd\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR \ufffdP\ufffd\u04e6\ufffdL<I\ufffd\u0540_\ufffde\ufffd\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffdF\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000P\ufffd\u04e6\ufffdL<I\ufffd\u0540_\ufffd\u0005e\ufffd\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR \ufffdP\ufffd\u04e6\ufffdL<I\ufffd\u0540_\ufffde\ufffd\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffdF\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R)lW 8QF\|�O�My��I� �RH��AK�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R)lW8QF\|�O�My��I� �RH��AK�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.590970699883485, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ee067ce3d1bb1f20c8aef2e4522a8289", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000W\u000b8QF\|\ufffdO\ufffdMy\ufffd\ufffd\ufffd\u001c\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000W\u000b8QF\|\ufffdO\ufffdMy\ufffd\ufffd\ufffd\u001c\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000W\u000b8QF\|\ufffdO\ufffdMy\ufffd\ufffd\ufffd\u001c\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000W\u000b8QF\|\ufffdO\ufffdMy\ufffd\ufffd\ufffd\u001c\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000W\u000b8QF\|\ufffdO\ufffdMy\ufffd\ufffd\ufffd\u001c\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1a8dfa685a241791721745f85bbb0f33404523ff", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000W\u000b8QF\|\ufffdO\ufffdMy\ufffd\ufffd\ufffd\u001c\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR)lW8QF\|\ufffdO\ufffdMy\ufffd\ufffd\ufffd\ufffdI\ufffd \ufffdRH\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000W\u000b8QF\|\ufffdO\ufffdMy\ufffd\ufffd\ufffd\u001c\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR)lW8QF\|\ufffdO\ufffdMy\ufffd\ufffd\ufffd\ufffdI\ufffd \ufffdRH\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R��Y�< �M�;`V�{ϡL�b�E� K�� ϱ Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R��Y�< �M�;`V�{ϡL�b�E� K�� ϱ Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.619587252392983, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "bbd64b3786cfb854e2d8542e05f6e064", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\ufffdY\ufffd<\u001e\r\ufffdM\ufffd;\u0019`V\ufffd\u0018{\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03f1\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\ufffdY\ufffd<\u001e\r\ufffdM\ufffd;\u0019`V\ufffd\u0018{\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03f1\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\ufffdY\ufffd<\u001e\r\ufffdM\ufffd;\u0019`V\ufffd\u0018{\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03f1\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\ufffdY\ufffd<\u001e\r\ufffdM\ufffd;\u0019`V\ufffd\u0018{\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03f1\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\ufffdY\ufffd<\u001e\r\ufffdM\ufffd;\u0019`V\ufffd\u0018{\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03f1\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b3fcc47a74ec29d02ed1ac171587f6293b8a8443", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\ufffdY\ufffd<\u001e\r\ufffdM\ufffd;\u0019`V\ufffd\u0018{\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03f1\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffdY\ufffd<\r\ufffdM\ufffd;`V\ufffd{\u03e1L\ufffdb\ufffdE\ufffd K\ufffd\ufffd\r\u03f1", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000\ufffdY\ufffd<\u001e\r\ufffdM\ufffd;\u0019`V\ufffd\u0018{\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03f1\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffdY\ufffd<\r\ufffdM\ufffd;`V\ufffd{\u03e1L\ufffdb\ufffdE\ufffd K\ufffd\ufffd\r\u03f1", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R4>Z�N��D�gڔ#44�6 �k�IwM�I�yT�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R4>Z�N��D�gڔ#44�6 �k�IwM�I�yT�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.519110194541321, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "11c07377a2843cde1fe4a0709a73f2e5", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000>Z\ufffdN\ufffd\u0007\ufffdD\ufffdg\u0694#44\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000>Z\ufffdN\ufffd\u0007\ufffdD\ufffdg\u0694#44\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000>Z\ufffdN\ufffd\u0007\ufffdD\ufffdg\u0694#44\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000>Z\ufffdN\ufffd\u0007\ufffdD\ufffdg\u0694#44\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000>Z\ufffdN\ufffd\u0007\ufffdD\ufffdg\u0694#44\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "685559b54bbfb1a9210883eda1778f39795cc76d", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000>Z\ufffdN\ufffd\u0007\ufffdD\ufffdg\u0694#44\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR4>Z\ufffdN\ufffd\ufffdD\ufffdg\u0694#44\ufffd6\n\ufffdk\ufffdIwM\ufffdI\ufffdyT\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000>Z\ufffdN\ufffd\u0007\ufffdD\ufffdg\u0694#44\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR4>Z\ufffdN\ufffd\ufffdD\ufffdg\u0694#44\ufffd6\n\ufffdk\ufffdIwM\ufffdI\ufffdyT\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R�� ZS�C�2z=�τ��1� �wH��9�7� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R��ZS�C�2z=�τ��1� �wH��9�7� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.640863848137664, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4449d373672af9c33406885dd473e908", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffd\u000bZ\u0013S\ufffdC\ufffd2z\u0011=\ufffd\u03c4\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffd\u000bZ\u0013S\ufffdC\ufffd2z\u0011=\ufffd\u03c4\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffd\u000bZ\u0013S\ufffdC\ufffd2z\u0011=\ufffd\u03c4\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffd\u000bZ\u0013S\ufffdC\ufffd2z\u0011=\ufffd\u03c4\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffd\u000bZ\u0013S\ufffdC\ufffd2z\u0011=\ufffd\u03c4\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e942cd295def686816bfdd4d63cc8e82effef21b", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffd\u000bZ\u0013S\ufffdC\ufffd2z\u0011=\ufffd\u03c4\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffdZS\ufffdC\ufffd2z=\ufffd\u03c4\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffd\u000bZ\u0013S\ufffdC\ufffd2z\u0011=\ufffd\u03c4\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffdZS\ufffdC\ufffd2z=\ufffd\u03c4\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R4pjz{}��@�^�T.�H��kepqC�NS,�K� Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R4pjz{}��@�^�T.�H��kepqC�NS,�K� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.548417508394124, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c2a9afcfe10490cb109d4f857c670cbc", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000pjz{}\ufffd\ufffd@\ufffd^\ufffdT.\ufffdH\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000pjz{}\ufffd\ufffd@\ufffd^\ufffdT.\ufffdH\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000pjz{}\ufffd\ufffd@\ufffd^\ufffdT.\ufffdH\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000pjz{}\ufffd\ufffd@\ufffd^\ufffdT.\ufffdH\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000pjz{}\ufffd\ufffd@\ufffd^\ufffdT.\ufffdH\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "633cd34f2971647af8f37d9e7864282210d6034d", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000pjz{}\ufffd\ufffd@\ufffd^\ufffdT.\ufffdH\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR4pjz{}\ufffd\ufffd@\ufffd^\ufffdT.\ufffdH\ufffd\ufffd\ufffdkepqC\ufffdNS,\ufffdK\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000pjz{}\ufffd\ufffd@\ufffd^\ufffdT.\ufffdH\ufffd\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR4pjz{}\ufffd\ufffd@\ufffd^\ufffdT.\ufffdH\ufffd\ufffd\ufffdkepqC\ufffdNS,\ufffdK\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R&T0��N��O�\JZm�h�D�E�LK$�˳ Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R&T0��N��O�\JZm�h�D�E�LK$�˳ Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.582249220432058, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "906232998ac300d754fc6fc2ba979d91", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u00000\ufffd\u009f\ufffd\ufffdN\ufffd\ufffd\u001dO\ufffd\\JZm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02f3\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u00000\ufffd\u009f\ufffd\ufffdN\ufffd\ufffd\u001dO\ufffd\\JZm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02f3\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u00000\ufffd\u009f\ufffd\ufffdN\ufffd\ufffd\u001dO\ufffd\\JZm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02f3\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u00000\ufffd\u009f\ufffd\ufffdN\ufffd\ufffd\u001dO\ufffd\\JZm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02f3\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u00000\ufffd\u009f\ufffd\ufffdN\ufffd\ufffd\u001dO\ufffd\\JZm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02f3\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4240e69b03248814a26163cf77e05c00017a8c5e", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u00000\ufffd\u009f\ufffd\ufffdN\ufffd\ufffd\u001dO\ufffd\\JZm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02f3\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR&T0\ufffd\u009f\ufffd\ufffdN\ufffd\ufffdO\ufffd\\JZm\ufffdh\ufffdD\ufffdE\ufffdLK$\ufffd\u02f3", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u00000\ufffd\u009f\ufffd\ufffdN\ufffd\ufffd\u001dO\ufffd\\JZm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02f3\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR&T0\ufffd\u009f\ufffd\ufffdN\ufffd\ufffdO\ufffd\\JZm\ufffdh\ufffdD\ufffdE\ufffdLK$\ufffd\u02f3", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R"<"�T��M�H�ʈo��Dq��x�L��,Pf�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R"<"�T��M�H�ʈo��Dq��x�L��,Pf�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.662140443882345, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7c4142029fef103a747885851148a06c", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\"\ufffdT\ufffd\ufffdM\ufffdH\ufffd\u0288o\ufffd\u0018\ufffd\ufffdDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\"\ufffdT\ufffd\ufffdM\ufffdH\ufffd\u0288o\ufffd\u0018\ufffd\ufffdDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\"\ufffdT\ufffd\ufffdM\ufffdH\ufffd\u0288o\ufffd\u0018\ufffd\ufffdDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\"\ufffdT\ufffd\ufffdM\ufffdH\ufffd\u0288o\ufffd\u0018\ufffd\ufffdDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\"\ufffdT\ufffd\ufffdM\ufffdH\ufffd\u0288o\ufffd\u0018\ufffd\ufffdDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "02a44d77d262c16bd4ec5a45dfd8940145afe1b0", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\"\ufffdT\ufffd\ufffdM\ufffdH\ufffd\u0288o\ufffd\u0018\ufffd\ufffdDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\"<\"\ufffdT\ufffd\ufffdM\ufffdH\ufffd\u0288o\ufffd\ufffd\ufffdDq\ufffd\ufffdx\ufffdL\ufffd\ufffd,Pf\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\"\ufffdT\ufffd\ufffdM\ufffdH\ufffd\u0288o\ufffd\u0018\ufffd\ufffdDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\"<\"\ufffdT\ufffd\ufffdM\ufffdH\ufffd\u0288o\ufffd\ufffd\ufffdDq\ufffd\ufffdx\ufffdL\ufffd\ufffd,Pf\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R �8sx]��}F�K%]r=0��B!1I�� O<�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R �8sx]��}F�K%]r=0��B!1I�� O<�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.5983106566483025, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "daedda03f8a23e0077d424ac8196ccf0", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u00008sx]\ufffd\ufffd}F\ufffdK%]r=0\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u00008sx]\ufffd\ufffd}F\ufffdK%]r=0\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u00008sx]\ufffd\ufffd}F\ufffdK%]r=0\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u00008sx]\ufffd\ufffd}F\ufffdK%]r=0\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u00008sx]\ufffd\ufffd}F\ufffdK%]r=0\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "76e9cdb60b4e52d120aea573ca0586a1b7ef5a48", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u00008sx]\ufffd\ufffd}F\ufffdK%]r=0\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\r\ufffd8sx]\ufffd\ufffd}F\ufffdK%]r=0\ufffd\ufffd\ufffd\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\r\ufffd\u00008sx]\ufffd\ufffd}F\ufffdK%]r=0\ufffd\ufffd\ufffd\u001e\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\u0019\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\r\ufffd8sx]\ufffd\ufffd}F\ufffdK%]r=0\ufffd\ufffd\ufffd\ufffdB!1I\ufffd\ufffd \ufffdO<\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R8�Y��w�#H��=p�X諪(�v�LN�&�(�/6� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R8�Y��w�#H��=p�X諪(�v�LN�&�(�/6� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.662140443882345, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "dc87cd116442f8bc687819023c586476", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffdY\ufffd\ufffdw\ufffd#H\ufffd\ufffd\ufffd=p\ufffdX\u8aea(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffdY\ufffd\ufffdw\ufffd#H\ufffd\ufffd\ufffd=p\ufffdX\u8aea(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffdY\ufffd\ufffdw\ufffd#H\ufffd\ufffd\ufffd=p\ufffdX\u8aea(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffdY\ufffd\ufffdw\ufffd#H\ufffd\ufffd\ufffd=p\ufffdX\u8aea(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffdY\ufffd\ufffdw\ufffd#H\ufffd\ufffd\ufffd=p\ufffdX\u8aea(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c83a3787e77b197f0aba783062551e4124743106", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffdY\ufffd\ufffdw\ufffd#H\ufffd\ufffd\ufffd=p\ufffdX\u8aea(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR8\ufffdY\ufffd\ufffdw\ufffd#H\ufffd\ufffd\ufffd=p\ufffdX\u8aea(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/6\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\ufffdY\ufffd\ufffdw\ufffd#H\ufffd\ufffd\ufffd=p\ufffdX\u8aea(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR8\ufffdY\ufffd\ufffdw\ufffd#H\ufffd\ufffd\ufffd=p\ufffdX\u8aea(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/6\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�RH�ߗ�~O��b�_��L歽rvA�U�X�m� Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�RH�ߗ�~O��b�_��L歽rvA�U�X�m� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.640863848137664, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1a03ff42b36db8ca5dd86230eebd8c63", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000H\ufffd\u07d7\ufffd~\bO\ufffd\ufffdb\ufffd\u001c_\ufffd\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000H\ufffd\u07d7\ufffd~\bO\ufffd\ufffdb\ufffd\u001c_\ufffd\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000H\ufffd\u07d7\ufffd~\bO\ufffd\ufffdb\ufffd\u001c_\ufffd\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000H\ufffd\u07d7\ufffd~\bO\ufffd\ufffdb\ufffd\u001c_\ufffd\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000H\ufffd\u07d7\ufffd~\bO\ufffd\ufffdb\ufffd\u001c_\ufffd\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5ff45a82bef053c2c0ccd34fe0641d48025bc710", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000H\ufffd\u07d7\ufffd~\bO\ufffd\ufffdb\ufffd\u001c_\ufffd\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdRH\ufffd\u07d7\ufffd~O\ufffd\ufffdb\ufffd_\ufffd\ufffdL\u6b7drvA\ufffdU\ufffdX\ufffdm\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001e\u0014\u0000H\ufffd\u07d7\ufffd~\bO\ufffd\ufffdb\ufffd\u001c_\ufffd\ufffdL\u6b7dr\u0011vA\ufffdU\ufffdX\u0018\ufffdm\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdRH\ufffd\u07d7\ufffd~O\ufffd\ufffdb\ufffd_\ufffd\ufffdL\u6b7drvA\ufffdU\ufffdX\ufffdm\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R@l�6 D�Y��.�0�y��ԳH�j�ց河 Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R@l�6 D�Y��.�0�y��ԳH�j�ց河 Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.540386790286002, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0362729c187a3044be9b27c27d459ce6", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000l\u0014\ufffd6\t\u0001\u0006D\ufffdY\ufffd\ufffd\b.\ufffd0\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cb3\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000l\u0014\ufffd6\t\u0001\u0006D\ufffdY\ufffd\ufffd\b.\ufffd0\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cb3\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000l\u0014\ufffd6\t\u0001\u0006D\ufffdY\ufffd\ufffd\b.\ufffd0\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cb3\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000l\u0014\ufffd6\t\u0001\u0006D\ufffdY\ufffd\ufffd\b.\ufffd0\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cb3\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000l\u0014\ufffd6\t\u0001\u0006D\ufffdY\ufffd\ufffd\b.\ufffd0\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cb3\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e4dd3ed890cff1adec900363751e1fe79265c797", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000l\u0014\ufffd6\t\u0001\u0006D\ufffdY\ufffd\ufffd\b.\ufffd0\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cb3\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR@l\ufffd6\tD\ufffdY\ufffd\ufffd.\ufffd0\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffdj\ufffd\u0581\u6cb3", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0003@\u0000l\u0014\ufffd6\t\u0001\u0006D\ufffdY\ufffd\ufffd\b.\ufffd0\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffd\u0017j\ufffd\u0581\u6cb3\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR@l\ufffd6\tD\ufffdY\ufffd\ufffd.\ufffd0\ufffdy\ufffd\ufffd\ufffd\u0533H\ufffdj\ufffd\u0581\u6cb3", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�RPu) ��iJ��9X8:RW��WIK��x��B� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�RPu) ��iJ��9X8:RW��WIK��x��B� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.619587252392983, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "17438b00646207e985259478ee418d46", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000u)\n\ufffd\ufffd\ufffdiJ\ufffd\ufffd\ufffd9X8:RW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000u)\n\ufffd\ufffd\ufffdiJ\ufffd\ufffd\ufffd9X8:RW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000u)\n\ufffd\ufffd\ufffdiJ\ufffd\ufffd\ufffd9X8:RW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000u)\n\ufffd\ufffd\ufffdiJ\ufffd\ufffd\ufffd9X8:RW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000u)\n\ufffd\ufffd\ufffdiJ\ufffd\ufffd\ufffd9X8:RW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8eade7cd577f7a5d33997c8a15357dbfc4ed02c5", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000u)\n\ufffd\ufffd\ufffdiJ\ufffd\ufffd\ufffd9X8:RW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdRPu)\n\ufffd\ufffd\ufffdiJ\ufffd\ufffd\ufffd9X8:RW\ufffd\ufffd\ufffdWIK\ufffd\ufffdx\ufffd\ufffdB\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0005P\u0000u)\n\ufffd\ufffd\ufffdiJ\ufffd\ufffd\ufffd9X8:RW\ufffd\ufffd\ufffdWI\u0017K\ufffd\ufffdx\ufffd\u000f\u0002\ufffdB\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdRPu)\n\ufffd\ufffd\ufffdiJ\ufffd\ufffd\ufffd9X8:RW\ufffd\ufffd\ufffdWIK\ufffd\ufffdx\ufffd\ufffdB\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R�^�2��D�!� �4!��XM�F� ؎�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R�^�2��D�!� �4!��XM�F� ؎�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.555757465158941, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "bf3564393cd6bdb661ed48718140e217", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000^\ufffd\u00142\ufffd\ufffd\ufffdD\ufffd!\u0006\ufffd\n\u001c\ufffd4\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000^\ufffd\u00142\ufffd\ufffd\ufffdD\ufffd!\u0006\ufffd\n\u001c\ufffd4\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000^\ufffd\u00142\ufffd\ufffd\ufffdD\ufffd!\u0006\ufffd\n\u001c\ufffd4\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000^\ufffd\u00142\ufffd\ufffd\ufffdD\ufffd!\u0006\ufffd\n\u001c\ufffd4\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000^\ufffd\u00142\ufffd\ufffd\ufffdD\ufffd!\u0006\ufffd\n\u001c\ufffd4\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d9331415360f1fe4c43b8e494e95b7f276c79642", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000^\ufffd\u00142\ufffd\ufffd\ufffdD\ufffd!\u0006\ufffd\n\u001c\ufffd4\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd^\ufffd2\ufffd\ufffd\ufffdD\ufffd!\ufffd\n\ufffd4!\ufffd\ufffdXM\ufffdF\ufffd\r\u060e\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0015\ufffd\u0000^\ufffd\u00142\ufffd\ufffd\ufffdD\ufffd!\u0006\ufffd\n\u001c\ufffd4\u0016\u001f\u0004!\ufffd\ufffdXM\ufffdF\u000f\ufffd\r\u060e\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd^\ufffd2\ufffd\ufffd\ufffdD\ufffd!\ufffd\n\ufffd4!\ufffd\ufffdXM\ufffdF\ufffd\r\u060e\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R �7�$%r��M��U�6��dd_�D��,N�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R�7�$%r��M��U�6��dd_�D��,N�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.539696028942697, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8bf1c103e0032b26f965f64501cd4ce5", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u00007\ufffd$%r\ufffd\ufffdM\ufffd\ufffdU\u001e\ufffd\u00126\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u00007\ufffd$%r\ufffd\ufffdM\ufffd\ufffdU\u001e\ufffd\u00126\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u00007\ufffd$%r\ufffd\ufffdM\ufffd\ufffdU\u001e\ufffd\u00126\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u00007\ufffd$%r\ufffd\ufffdM\ufffd\ufffdU\u001e\ufffd\u00126\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u00007\ufffd$%r\ufffd\ufffdM\ufffd\ufffdU\u001e\ufffd\u00126\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "66c551898eefe7f805bd7f5baa596b75df37626c", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u00007\ufffd$%r\ufffd\ufffdM\ufffd\ufffdU\u001e\ufffd\u00126\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd7\ufffd$%r\ufffd\ufffdM\ufffd\ufffdU\ufffd6\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\f\ufffd\u00007\ufffd$%r\ufffd\ufffdM\ufffd\ufffdU\u001e\ufffd\u00126\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd7\ufffd$%r\ufffd\ufffdM\ufffd\ufffdU\ufffd6\ufffd\ufffd\ufffd\ufffddd_\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd,N\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:02 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R��u �C��O)5��f�&R\��7K��#h�._� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R��u�C��O)5��f�&R\��7K��#h�._� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.632833130029542, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ccece960c2c76b643b70b15acdc6c058", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\u0002\ufffd\u0002u\u000b\u000f\ufffdC\ufffd\ufffdO)5\ufffd\ufffdf\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\u0002\ufffd\u0002u\u000b\u000f\ufffdC\ufffd\ufffdO)5\ufffd\ufffdf\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\u0002\ufffd\u0002u\u000b\u000f\ufffdC\ufffd\ufffdO)5\ufffd\ufffdf\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\u0002\ufffd\u0002u\u000b\u000f\ufffdC\ufffd\ufffdO)5\ufffd\ufffdf\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\u0002\ufffd\u0002u\u000b\u000f\ufffdC\ufffd\ufffdO)5\ufffd\ufffdf\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e0a6df5aadb73f50cb90ce3aec780020d0c42269", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\u0002\ufffd\u0002u\u000b\u000f\ufffdC\ufffd\ufffdO)5\ufffd\ufffdf\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffdu\ufffdC\ufffd\ufffdO)5\ufffd\ufffdf\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\ufffd._\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0013\ufffd\u0000\u0002\ufffd\u0002u\u000b\u000f\ufffdC\ufffd\ufffdO)5\ufffd\ufffdf\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\u001a\ufffd._\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffdu\ufffdC\ufffd\ufffdO)5\ufffd\ufffdf\ufffd&R\\\ufffd\ufffd7K\ufffd\ufffd#h\ufffd._\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:02 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R�l��A�?�O[�_ek��@��n��z�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R�l��A�?�O[�_ek��@��n��z�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.640863848137665, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0c571dea2abcaa7df76803129882f09e", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000\ufffdl\ufffd\u001e\ufffdA\ufffd?\ufffdO\u0017[\ufffd\u0017_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000\ufffdl\ufffd\u001e\ufffdA\ufffd?\ufffdO\u0017[\ufffd\u0017_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000\ufffdl\ufffd\u001e\ufffdA\ufffd?\ufffdO\u0017[\ufffd\u0017_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000\ufffdl\ufffd\u001e\ufffdA\ufffd?\ufffdO\u0017[\ufffd\u0017_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000\ufffdl\ufffd\u001e\ufffdA\ufffd?\ufffdO\u0017[\ufffd\u0017_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "71b70f775f056103d04293cd28790be2de7fef1a", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000\ufffdl\ufffd\u001e\ufffdA\ufffd?\ufffdO\u0017[\ufffd\u0017_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffdl\ufffd\ufffdA\ufffd?\ufffdO[\ufffd_ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0007\u001c\u0000\ufffdl\ufffd\u001e\ufffdA\ufffd?\ufffdO\u0017[\ufffd\u0017_e\u001ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffdl\ufffd\ufffdA\ufffd?\ufffdO[\ufffd_ek\ufffd\ufffd\ufffd@\ufffd\ufffdn\ufffd\ufffdz\ufffd\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:02 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�Rd�ȏ��J�\.W�b�ZG4��D~?K�KiSY?�[� Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�Rd�ȏ��J�\.W�b�ZG4��D~?K�KiSY?�[� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.619587252392985, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "065ef29e770d29f5b14ea5351b71e412", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000\ufffd\u020f\u0003\ufffd\ufffd\ufffdJ\ufffd\\.W\ufffdb\ufffdZG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000\ufffd\u020f\u0003\ufffd\ufffd\ufffdJ\ufffd\\.W\ufffdb\ufffdZG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000\ufffd\u020f\u0003\ufffd\ufffd\ufffdJ\ufffd\\.W\ufffdb\ufffdZG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000\ufffd\u020f\u0003\ufffd\ufffd\ufffdJ\ufffd\\.W\ufffdb\ufffdZG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000\ufffd\u020f\u0003\ufffd\ufffd\ufffdJ\ufffd\\.W\ufffdb\ufffdZG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d2edd03fca97e441d41ac37c668a31b4928bd089", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000\ufffd\u020f\u0003\ufffd\ufffd\ufffdJ\ufffd\\.W\ufffdb\ufffdZG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdRd\ufffd\u020f\ufffd\ufffd\ufffdJ\ufffd\\.W\ufffdb\ufffdZG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000d\u0000\ufffd\u020f\u0003\ufffd\ufffd\ufffdJ\ufffd\\.W\ufffdb\ufffdZG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdRd\ufffd\u020f\ufffd\ufffd\ufffdJ\ufffd\\.W\ufffdb\ufffdZG4\ufffd\ufffdD~?K\ufffdKiSY?\ufffd[\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:02 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R\|0p��`G��XS��4��eh�B��M�n8� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R\|0p��`G��XS��4��eh�B��M�n8� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.640863848137664, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3c0a01cbbe887dda02926388b7cfb948", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u00000p\ufffd\ufffd\ufffd\ufffd`G\ufffd\ufffdXS\ufffd\ufffd\ufffd\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u00000p\ufffd\ufffd\ufffd\ufffd`G\ufffd\ufffdXS\ufffd\ufffd\ufffd\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u00000p\ufffd\ufffd\ufffd\ufffd`G\ufffd\ufffdXS\ufffd\ufffd\ufffd\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u00000p\ufffd\ufffd\ufffd\ufffd`G\ufffd\ufffdXS\ufffd\ufffd\ufffd\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u00000p\ufffd\ufffd\ufffd\ufffd`G\ufffd\ufffdXS\ufffd\ufffd\ufffd\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "965dfada0140cd28a8e0eb3294f7ca0602d47c0c", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u00000p\ufffd\ufffd\ufffd\ufffd`G\ufffd\ufffdXS\ufffd\ufffd\ufffd\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\|0p\ufffd\ufffd\ufffd\ufffd`G\ufffd\ufffdXS\ufffd\ufffd\ufffd\ufffd4\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u000e\|\u00000p\ufffd\ufffd\ufffd\ufffd`G\ufffd\ufffdXS\ufffd\ufffd\ufffd\ufffd4\u0019\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\|0p\ufffd\ufffd\ufffd\ufffd`G\ufffd\ufffdXS\ufffd\ufffd\ufffd\ufffd4\ufffd\ufffdeh\ufffdB\ufffd\ufffd\ufffd\ufffdM\ufffdn8\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:02 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R �I�§��[K�u}�f~ض��.�C��E��2��F�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R �I�§��[K�u}�f~ض��.�C��E��2��F�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.683417039627026, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a8cb8751aab2869e959d4032fe471b60", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000I\ufffd\u00a7\ufffd\ufffd[K\ufffdu}\ufffdf~\u0636\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000I\ufffd\u00a7\ufffd\ufffd[K\ufffdu}\ufffdf~\u0636\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000I\ufffd\u00a7\ufffd\ufffd[K\ufffdu}\ufffdf~\u0636\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000I\ufffd\u00a7\ufffd\ufffd[K\ufffdu}\ufffdf~\u0636\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000I\ufffd\u00a7\ufffd\ufffd[K\ufffdu}\ufffdf~\u0636\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "64d6e6f280d396ab7fe8951384efc28384e2c348", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000I\ufffd\u00a7\ufffd\ufffd[K\ufffdu}\ufffdf~\u0636\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR \ufffdI\ufffd\u00a7\ufffd\ufffd[K\ufffdu}\ufffdf~\u0636\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffdF\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000 \ufffd\u0000I\ufffd\u00a7\ufffd\ufffd[K\ufffdu}\ufffdf~\u0636\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffd\u0014F\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR \ufffdI\ufffd\u00a7\ufffd\ufffd[K\ufffdu}\ufffdf~\u0636\ufffd\ufffd.\ufffdC\ufffd\ufffdE\ufffd\ufffd2\ufffd\ufffdF\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:02 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R��XZ��C�b�]FF�΅h�AH��dt� � Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R��XZ��C�b�]FF�΅h�AH��dt� � Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.611556534284862, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4d3edfeff71e1e28fc7846f90f484b52", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000\ufffd\ufffdXZ\ufffd\ufffdC\ufffdb\ufffd]F\u0006F\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000\ufffd\ufffdXZ\ufffd\ufffdC\ufffdb\ufffd]F\u0006F\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000\ufffd\ufffdXZ\ufffd\ufffdC\ufffdb\ufffd]F\u0006F\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000\ufffd\ufffdXZ\ufffd\ufffdC\ufffdb\ufffd]F\u0006F\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000\ufffd\ufffdXZ\ufffd\ufffdC\ufffdb\ufffd]F\u0006F\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1032c4ea0c9f0d69c1eab1f2251b5626ceb05a2d", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000\ufffd\ufffdXZ\ufffd\ufffdC\ufffdb\ufffd]F\u0006F\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\ufffdXZ\ufffd\ufffdC\ufffdb\ufffd]FF\ufffd\u0385h\ufffdAH\ufffd\ufffddt\ufffd \ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u0000\ufffd\ufffdXZ\ufffd\ufffdC\ufffdb\ufffd]F\u0006F\ufffd\u0005\u0014\u0385h\ufffdAH\ufffd\ufffddt\ufffd \u000e\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffd\ufffdXZ\ufffd\ufffdC\ufffdb\ufffd]FF\ufffd\u0385h\ufffdAH\ufffd\ufffddt\ufffd \ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:02 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R4MO��WrB��6��6 �k�IwM�I�yT�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R4MO��WrB��6��6 �k�IwM�I�yT�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.540386790286002, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a367383826b9e57bda118a66f267c3ae", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000MO\ufffd\ufffd\u0006WrB\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000MO\ufffd\ufffd\u0006WrB\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000MO\ufffd\ufffd\u0006WrB\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000MO\ufffd\ufffd\u0006WrB\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000MO\ufffd\ufffd\u0006WrB\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "da315c8641f596e0b8b1c2373b9c01a89a32ffa0", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000MO\ufffd\ufffd\u0006WrB\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR4MO\ufffd\ufffdWrB\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd6\n\ufffdk\ufffdIwM\ufffdI\ufffdyT\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u00054\u0000MO\ufffd\ufffd\u0006WrB\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd6\n\ufffdk\ufffdIwM\ufffd\u0001I\ufffdyT\u000f\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR4MO\ufffd\ufffdWrB\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd6\n\ufffdk\ufffdIwM\ufffdI\ufffdyT\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:02 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R�SGG��\DF��l��ϡL�b�E� K�� ϯ Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R�SGG��\DF��l��ϡL�b�E� K�� ϯ Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.640863848137664, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d9b1edd11388a2095dab9242c70389db", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000SGG\ufffd\ufffd\\DF\ufffd\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffd\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03ef\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000SGG\ufffd\ufffd\\DF\ufffd\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffd\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03ef\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000SGG\ufffd\ufffd\\DF\ufffd\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffd\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03ef\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000SGG\ufffd\ufffd\\DF\ufffd\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffd\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03ef\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000SGG\ufffd\ufffd\\DF\ufffd\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffd\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03ef\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2b9ce564ed671c214bef4053cbc7fe25d1ac0afb", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000SGG\ufffd\ufffd\\DF\ufffd\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffd\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03ef\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffdSGG\ufffd\ufffd\\DF\ufffd\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffd\u03e1L\ufffdb\ufffdE\ufffd K\ufffd\ufffd\r\u03ef", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u0011\ufffd\u0000SGG\ufffd\ufffd\\DF\ufffd\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffd\u03e1L\ufffd\u0002b\ufffdE\ufffd K\ufffd\ufffd\u000b\r\u03ef\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffdSGG\ufffd\ufffd\\DF\ufffd\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffd\u03e1L\ufffdb\ufffdE\ufffd K\ufffd\ufffd\r\u03ef", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:02 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R)l�0�TG~@��^�I� �RH��AK�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R)l�0�TG~@��^�I� �RH��AK�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.527140912649443, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "80f06a5e3381acaa0fc19999247ffe52", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\ufffd0\u001b\ufffdTG~@\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\ufffd0\u001b\ufffdTG~@\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\ufffd0\u001b\ufffdTG~@\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\ufffd0\u001b\ufffdTG~@\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\ufffd0\u001b\ufffdTG~@\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a7ea7360f38fd90ae5ed287425074500602a5e77", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\ufffd0\u001b\ufffdTG~@\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR)l\ufffd0\ufffdTG~@\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffdI\ufffd \ufffdRH\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000)l\u0000\ufffd0\u001b\ufffdTG~@\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffdI\ufffd \u0005\ufffdR\u0001H\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR)l\ufffd0\ufffdTG~@\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffdI\ufffd \ufffdRH\ufffd\ufffd\ufffdAK\ufffd\ufffd\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:02 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R��p�E̡�A�T�ﳟi[��1� �wH��9�7� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R��p�E̡�A�T�ﳟi[��1� �wH��9�7� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.662140443882345, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "336dee0b5dc8cd0b5c27ce132a6828c2", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffdp\ufffdE\u0321\ufffdA\ufffdT\ufffd\ufcdfi[\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffdp\ufffdE\u0321\ufffdA\ufffdT\ufffd\ufcdfi[\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffdp\ufffdE\u0321\ufffdA\ufffdT\ufffd\ufcdfi[\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffdp\ufffdE\u0321\ufffdA\ufffdT\ufffd\ufcdfi[\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffdp\ufffdE\u0321\ufffdA\ufffdT\ufffd\ufcdfi[\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f16620fdb37376ce4567f3b215b29d91b44bf869", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffdp\ufffdE\u0321\ufffdA\ufffdT\ufffd\ufcdfi[\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffdp\ufffdE\u0321\ufffdA\ufffdT\ufffd\ufcdfi[\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\u001b\ufffd\u0000\ufffdp\ufffdE\u0321\ufffdA\ufffdT\ufffd\ufcdfi[\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\ufffd\ufffdp\ufffdE\u0321\ufffdA\ufffdT\ufffd\ufcdfi[\ufffd\ufffd1\ufffd \ufffdwH\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd7\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:02 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R"<�Ԕ��J��[t��RDq��x�L��,Pf�� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R"<�Ԕ��J��[t��RDq��x�L��,Pf�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.5983106566483025, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5f17a033e55d3dc313bcb72ef25ec9bd", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\u0007\ufffd\u0514\ufffd\ufffd\ufffdJ\ufffd\ufffd[\u0014t\ufffd\ufffdRDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\u0007\ufffd\u0514\ufffd\ufffd\ufffdJ\ufffd\ufffd[\u0014t\ufffd\ufffdRDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\u0007\ufffd\u0514\ufffd\ufffd\ufffdJ\ufffd\ufffd[\u0014t\ufffd\ufffdRDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\u0007\ufffd\u0514\ufffd\ufffd\ufffdJ\ufffd\ufffd[\u0014t\ufffd\ufffdRDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\u0007\ufffd\u0514\ufffd\ufffd\ufffdJ\ufffd\ufffd[\u0014t\ufffd\ufffdRDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a46cf3c1a9814d5b2bcd7460720f434f32034c14", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\u0007\ufffd\u0514\ufffd\ufffd\ufffdJ\ufffd\ufffd[\u0014t\ufffd\ufffdRDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR\"<\ufffd\u0514\ufffd\ufffd\ufffdJ\ufffd\ufffd[t\ufffd\ufffdRDq\ufffd\ufffdx\ufffdL\ufffd\ufffd,Pf\ufffd\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\"<\u0000\u0007\ufffd\u0514\ufffd\ufffd\ufffdJ\ufffd\ufffd[\u0014t\ufffd\ufffdRDq\ufffd\ufffdx\u000e\ufffdL\ufffd\ufffd,\u001a\u0010Pf\ufffd\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR\"<\ufffd\u0514\ufffd\ufffd\ufffdJ\ufffd\ufffd[t\ufffd\ufffdRDq\ufffd\ufffdx\ufffdL\ufffd\ufffd,Pf\ufffd\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:02 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R8 � �/g�G�R��(�v�LN�&�(�/6� Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R8� �/g�G�R��(�v�LN�&�(�/6� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.619587252392983, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0c97536553b0357755c504c38206aed8", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\f\ufffd\r\ufffd\/g\ufffdG\ufffdR\ufffd\ufffd\ufffd\u0015\u001f\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\f\ufffd\r\ufffd\/g\ufffdG\ufffdR\ufffd\ufffd\ufffd\u0015\u001f\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\f\ufffd\r\ufffd\/g\ufffdG\ufffdR\ufffd\ufffd\ufffd\u0015\u001f\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\f\ufffd\r\ufffd\/g\ufffdG\ufffdR\ufffd\ufffd\ufffd\u0015\u001f\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\f\ufffd\r\ufffd\/g\ufffdG\ufffdR\ufffd\ufffd\ufffd\u0015\u001f\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e2b50ed2debab08a82ee6dbc828119548fd9dd14", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\f\ufffd\r\ufffd\/g\ufffdG\ufffdR\ufffd\ufffd\ufffd\u0015\u001f\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR8\ufffd\r\ufffd\/g\ufffdG\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/6\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000\b8\u0000\f\ufffd\r\ufffd\/g\ufffdG\ufffdR\ufffd\ufffd\ufffd\u0015\u001f\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/\u001b6\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR8\ufffd\r\ufffd\/g\ufffdG\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffdv\ufffdLN\ufffd&\ufffd(\ufffd\/6\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:02 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R&T 0��ʦ�B��X��m�h�D�E�LK$�˱ Pourquoi cette classification :* Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R&T 0��ʦ�B��X��m�h�D�E�LK$�˱ Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.486181150823016, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a73f69d38002e84f8838a4d95aa9d891", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\n0\ufffd\ufffd\u02a6\ufffdB\ufffd\u0000\ufffdX\ufffd\u001d\u001f\ufffdm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02f1\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\n0\ufffd\ufffd\u02a6\ufffdB\ufffd\u0000\ufffdX\ufffd\u001d\u001f\ufffdm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02f1\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\n0\ufffd\ufffd\u02a6\ufffdB\ufffd\u0000\ufffdX\ufffd\u001d\u001f\ufffdm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02f1\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\n0\ufffd\ufffd\u02a6\ufffdB\ufffd\u0000\ufffdX\ufffd\u001d\u001f\ufffdm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02f1\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\n0\ufffd\ufffd\u02a6\ufffdB\ufffd\u0000\ufffdX\ufffd\u001d\u001f\ufffdm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02f1\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f549007185723b71ac008d821031509507ed6f06", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\n0\ufffd\ufffd\u02a6\ufffdB\ufffd\u0000\ufffdX\ufffd\u001d\u001f\ufffdm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02f1\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR&T\n0\ufffd\ufffd\u02a6\ufffdB\ufffd\ufffdX\ufffd\ufffdm\ufffdh\ufffdD\ufffdE\ufffdLK$\ufffd\u02f1", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u0000&T\u0000\n0\ufffd\ufffd\u02a6\ufffdB\ufffd\u0000\ufffdX\ufffd\u001d\u001f\ufffdm\u001f\ufffdh\u001f\ufffd\u0006D\ufffdE\ufffdLK$\ufffd\u02f1\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR&T\n0\ufffd\ufffd\u02a6\ufffdB\ufffd\ufffdX\ufffd\ufffdm\ufffdh\ufffdD\ufffdE\ufffdLK$\ufffd\u02f1", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }
27/07/2026 03:03:02 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload ^$+,01$U�R4�R�[{�D�-0��\| ��kepqC�NS,�K� Pourquoi cette classification : Rafale d'authentification SSH · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ^$+,01$U�R4�R�[{�D�-0��\| ��kepqC�NS,�K� Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000", "emulator_response_len": 33, "bytes_in": 94, "payload_entropy": 4.492618439268203, "port_category": "registered", "org": "SK Broadband Co Ltd", "service": "mssql", "app_proto": "mssql", "asn": 9318, "country": "KR", "dst_port": 1433, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10 }, "risk_score": 32, "tag_count": 6, "anomaly_count": 0, "campaign_key": "45706a8b34a3a5153991cf407febf3323fbbe868", "event_fingerprint": "cffec132105a0fdfea206358a7c4752f36cd84e4", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "mssql", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "KR", "asn": 9318, "org": "SK Broadband Co Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ea910c103ea0ec9295f2d8f1b3be1f5e", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 1433, "service": "mssql", "service_name": "mssql", "risk_score": 32 }, "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\ufffdR\ufffd\u0004[{\ufffdD\ufffd-0\ufffd\ufffd\u000e\|\t\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\ufffdR\ufffd\u0004[{\ufffdD\ufffd-0\ufffd\ufffd\u000e\|\t\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\ufffdR\ufffd\u0004[{\ufffdD\ufffd-0\ufffd\ufffd\u000e\|\t\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "evidence": { "request_sample": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\ufffdR\ufffd\u0004[{\ufffdD\ufffd-0\ufffd\ufffd\u000e\|\t\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "payload_snippet": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\ufffdR\ufffd\u0004[{\ufffdD\ufffd-0\ufffd\ufffd\u000e\|\t\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "413292c20e2c468f88cf99514f080fdb60a079ac", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\ufffdR\ufffd\u0004[{\ufffdD\ufffd-0\ufffd\ufffd\u000e\|\t\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "evidence_snippet": "^$+,01$U\ufffdR4\ufffdR\ufffd[{\ufffdD\ufffd-0\ufffd\ufffd\|\t\ufffd\ufffdkepqC\ufffdNS,\ufffdK\ufffd", "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 49%", "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 10, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "mssql", "service_label_fr": "MSSQL", "dst_port": 1433, "protocol_emulated": true, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mssql", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "mssql_tds_fr": "Connexion TDS Microsoft SQL Server", "payload_preview": "\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b\u0012R\u0000\u0000\u0001\u0000\u0000\u00004\u0000\ufffdR\ufffd\u0004[{\ufffdD\ufffd-0\ufffd\ufffd\u000e\|\t\ufffd\u0016\ufffdkepqC\ufffd\b\u0001NS,\ufffdK\ufffd\u0000\u0000\u0000\u0001", "port": 1433, "service": "mssql", "service_label_fr": "MSSQL" }, "attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)", "evidence_snippet": "^$+,01$U\ufffdR4\ufffdR\ufffd[{\ufffdD\ufffd-0\ufffd\ufffd\|\t\ufffd\ufffdkepqC\ufffdNS,\ufffdK\ufffd", "target_port_label": "1433 \u00b7 MSSQL", "emulator_service": "mssql", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mssql", "service_banner": "honeypot-mssql", "service_os": "linux", "dst_port": "1433" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_emulated", "mssql_payload", "mssql_probe", "mssql_tds", "net_bruteforce_burst", "net_flood" ] }

1.226.4.189

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence